diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index a9898e205f84..a477aaf4e940 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -6348,6 +6348,12 @@ static int smb2_get_info_sec(struct ksmbd_work *work, if (!fp) return -ENOENT; + if (le32_to_cpu(req->OutputBufferLength) < sizeof(struct smb_ntsd)) { + rsp->hdr.Status = STATUS_BUFFER_TOO_SMALL; + ksmbd_fd_put(work, fp); + return -ENOSPC; + } + idmap = file_mnt_idmap(fp->filp); inode = file_inode(fp->filp); ksmbd_acls_fattr(&fattr, idmap, inode);