diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index a05f2ccf0b3e..f02520f54c6f 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -9396,6 +9396,11 @@ int smb2_ioctl(struct ksmbd_work *work)
 		struct file_object_buf_type1_ioctl_rsp *obj_buf;
 		struct ksmbd_file *fp;
 
+		if (out_buf_len < sizeof(struct file_object_buf_type1_ioctl_rsp)) {
+			ret = -EINVAL;
+			goto out;
+		}
+
 		fp = ksmbd_lookup_fd_fast(work, id);
 		if (!fp) {
 			ret = -EBADF;
@@ -9591,6 +9596,11 @@ int smb2_ioctl(struct ksmbd_work *work)
 		struct reparse_data_buffer *reparse_ptr;
 		struct ksmbd_file *fp;
 
+		if (out_buf_len < sizeof(struct reparse_data_buffer)) {
+			ret = -EINVAL;
+			goto out;
+		}
+
 		reparse_ptr = (struct reparse_data_buffer *)&rsp->Buffer[0];
 		fp = ksmbd_lookup_fd_fast(work, id);
 		if (!fp) {