Merge: [CVE-2024-50151] smb: client: fix OOBs when building SMB2_IOCTL request

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/5810

JIRA: https://issues.redhat.com/browse/RHEL-66476

CVE: CVE-2024-50151

Signed-off-by: Paulo Alcantara <[email protected]>

Approved-by: Chris von Recklinghausen <[email protected]>
Approved-by: Benjamin Coddington <[email protected]>
Approved-by: CKI KWF Bot <[email protected]>

Merged-by: Rado Vrbovsky <[email protected]>

Author: emmil

fs/smb/client/smb2pdu.c

@@ -3300,6 +3300,15 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
 		return rc;
 
 	if (indatalen) {
+		unsigned int len;
+
+		if (WARN_ON_ONCE(smb3_encryption_required(tcon) &&
+				 (check_add_overflow(total_len - 1,
+						     ALIGN(indatalen, 8), &len) ||
+				  len > MAX_CIFS_SMALL_BUFFER_SIZE))) {
+			cifs_small_buf_release(req);
+			return -EIO;
+		}
 		/*
 		 * indatalen is usually small at a couple of bytes max, so
 		 * just allocate through generic pool