From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Steve French <stfrench@microsoft.com>,
"Paulo Alcantara (SUSE)" <pc@manguebit.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.1.y 1/2] smb3: make query_on_disk_id open context consistent and move to common code
Date: Wed, 30 Sep 2026 11:15:38 -0400 [thread overview]
Message-ID: <20260930151539.2562092-1-sashal@kernel.org> (raw)
In-Reply-To: <2026092929-survey-cost-ee4b@gregkh>
From: Steve French <stfrench@microsoft.com>
[ Upstream commit 1149c8467ddebfb6bb9aab37830f70a49cab7085 ]
cifs and ksmbd were using a slightly different version of the query_on_disk_id
struct which could be confusing. Use the ksmbd version of this struct, and
move it to common code.
Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: 67f4c1c6a1b5 ("smb: client: fix create context out-of-bounds reads")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2pdu.c | 2 +-
fs/smb/client/smb2pdu.h | 9 ---------
fs/smb/common/smb2pdu.h | 11 +++++++++++
fs/smb/server/smb2pdu.h | 8 --------
4 files changed, 12 insertions(+), 18 deletions(-)
diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
index 98d6fcdf22365..984babcecc21d 100644
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -2179,7 +2179,7 @@ create_reconnect_durable_buf(struct cifs_fid *fid)
static void
parse_query_id_ctxt(struct create_context *cc, struct smb2_file_all_info *buf)
{
- struct create_on_disk_id *pdisk_id = (struct create_on_disk_id *)cc;
+ struct create_disk_id_rsp *pdisk_id = (struct create_disk_id_rsp *)cc;
cifs_dbg(FYI, "parse query id context 0x%llx 0x%llx\n",
pdisk_id->DiskFileId, pdisk_id->VolumeId);
diff --git a/fs/smb/client/smb2pdu.h b/fs/smb/client/smb2pdu.h
index d12ca9c7e62bc..2c2a2177b553c 100644
--- a/fs/smb/client/smb2pdu.h
+++ b/fs/smb/client/smb2pdu.h
@@ -170,15 +170,6 @@ struct durable_reconnect_context_v2 {
__le32 Flags; /* see above DHANDLE_FLAG_PERSISTENT */
} __packed;
-/* See MS-SMB2 2.2.14.2.9 */
-struct create_on_disk_id {
- struct create_context ccontext;
- __u8 Name[8];
- __le64 DiskFileId;
- __le64 VolumeId;
- __u32 Reserved[4];
-} __packed;
-
/* See MS-SMB2 2.2.14.2.12 */
struct durable_reconnect_context_v2_rsp {
__le32 Timeout;
diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h
index 7d69a2a1d3ba4..430b65512228f 100644
--- a/fs/smb/common/smb2pdu.h
+++ b/fs/smb/common/smb2pdu.h
@@ -1240,6 +1240,7 @@ struct create_posix {
#define SMB2_LEASE_KEY_SIZE 16
+/* See MS-SMB2 2.2.13.2.8 */
struct lease_context {
__u8 LeaseKey[SMB2_LEASE_KEY_SIZE];
__le32 LeaseState;
@@ -1247,6 +1248,7 @@ struct lease_context {
__le64 LeaseDuration;
} __packed;
+/* See MS-SMB2 2.2.13.2.10 */
struct lease_context_v2 {
__u8 LeaseKey[SMB2_LEASE_KEY_SIZE];
__le32 LeaseState;
@@ -1270,6 +1272,15 @@ struct create_lease_v2 {
__u8 Pad[4];
} __packed;
+/* See MS-SMB2 2.2.14.2.9 */
+struct create_disk_id_rsp {
+ struct create_context ccontext;
+ __u8 Name[8];
+ __le64 DiskFileId;
+ __le64 VolumeId;
+ __u8 Reserved[16];
+} __packed;
+
/* See MS-SMB2 2.2.31 and 2.2.32 */
struct smb2_ioctl_req {
struct smb2_hdr hdr;
diff --git a/fs/smb/server/smb2pdu.h b/fs/smb/server/smb2pdu.h
index 6011fca980456..7518aa42f11ed 100644
--- a/fs/smb/server/smb2pdu.h
+++ b/fs/smb/server/smb2pdu.h
@@ -146,14 +146,6 @@ struct create_mxac_rsp {
__le32 MaximalAccess;
} __packed;
-struct create_disk_id_rsp {
- struct create_context ccontext;
- __u8 Name[8];
- __le64 DiskFileId;
- __le64 VolumeId;
- __u8 Reserved[16];
-} __packed;
-
/* equivalent of the contents of SMB3.1.1 POSIX open context response */
struct create_posix_rsp {
struct create_context ccontext;
--
2.53.0
next prev parent reply other threads:[~2026-09-30 15:15 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-29 11:50 FAILED: patch "[PATCH] smb: client: fix create context out-of-bounds reads" failed to apply to 6.1-stable tree gregkh
2026-09-30 15:15 ` Sasha Levin [this message]
2026-09-30 15:15 ` [PATCH 6.1.y 2/2] smb: client: fix create context out-of-bounds reads Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260930151539.2562092-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=pc@manguebit.com \
--cc=stable@vger.kernel.org \
--cc=stfrench@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.