A bad SMB server could make the client write off a reply buffer
Brief
This is the client, not the in-kernel SMB server card already on the site.
Notes
6343c1da5619 (Frank Sorenson) landed via merge ce14fe4cd756 (cifs-fixes-7.3-rc1, Aug 24 18:11 PT). Client multi-part reply offset out-of-bounds write. You have to mount that server. Fixes ancestor e4eb295d38b5. Cc:stable. Reported-by Shen Yongchao.
Not the ksmbd short-packet read and not the Ceph client short-reply.
Commit 6343c1da561962688f203362d80d6a3bfa39fa1b