From 2103add92a02505bdd536ba6fce7f64a427222a2 Mon Sep 17 00:00:00 2001 From: Namjae Jeon Date: Tue, 7 Jul 2026 00:19:39 +0900 Subject: [PATCH] ksmbd: return buffer too small for short security queries SMB2 QUERY_INFO security requests with an output buffer too small for the self-relative security descriptor header can fall through descriptor construction and be reported as STATUS_INVALID_INFO_CLASS. After validating the file handle, reject buffers shorter than struct smb_ntsd with STATUS_BUFFER_TOO_SMALL before building the descriptor. This fixes smb2.getinfo.qsec_buffercheck. Signed-off-by: Namjae Jeon --- fs/smb/server/smb2pdu.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index a9898e205f84..a477aaf4e940 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -6348,6 +6348,12 @@ static int smb2_get_info_sec(struct ksmbd_work *work, if (!fp) return -ENOENT; + if (le32_to_cpu(req->OutputBufferLength) < sizeof(struct smb_ntsd)) { + rsp->hdr.Status = STATUS_BUFFER_TOO_SMALL; + ksmbd_fd_put(work, fp); + return -ENOSPC; + } + idmap = file_mnt_idmap(fp->filp); inode = file_inode(fp->filp); ksmbd_acls_fattr(&fattr, idmap, inode);