smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL
and the default QUERY_INFO path.  The QUERY_INFO branch clamps
qi.input_buffer_length to the server-reported OutputBufferLength and then
copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but
it never verifies that the flexible-array payload actually fits within
rsp_iov[1].iov_len.

A malicious server can return OutputBufferLength larger than the actual
QUERY_INFO response, causing copy_to_user() to walk past the response
buffer and expose adjacent kernel heap to userspace.

Guard the QUERY_INFO copy with a bounds check on the actual Buffer
payload.  Use struct_size(qi_rsp, Buffer, qi.input_buffer_length)
rather than an open-coded addition so the guard cannot overflow on
32-bit builds.

Fixes: f5778c398713 ("SMB3: Allow SMB3 FSCTL queries to be sent to server from tools")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-6
Assisted-by: Codex:gpt-5-4
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index a2105f4b54db756590d6d08737c8878b7973cb13..7f346ee502896410a91b023063de2c81c38b12f3 100644 (file)
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -1783,6 +1783,12 @@ replay_again:
                qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base;
                if (le32_to_cpu(qi_rsp->OutputBufferLength) < qi.input_buffer_length)
                        qi.input_buffer_length = le32_to_cpu(qi_rsp->OutputBufferLength);
+               if (qi.input_buffer_length > 0 &&
+                   struct_size(qi_rsp, Buffer, qi.input_buffer_length) >
+                   rsp_iov[1].iov_len) {
+                       rc = -EFAULT;
+                       goto out;
+               }
                if (copy_to_user(&pqi->input_buffer_length,
                                 &qi.input_buffer_length,
                                 sizeof(qi.input_buffer_length))) {