From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793831248; b=gSfl1j1D06syIfWRZq2qZCWXZHp0zcvem6ZdUw4q30yNPfx6TpL6lNwLYaiAtM3q5KT5 TNJpfAdJQyILVurM67OIy7Tr8REaLe8JqboiAKYNJDDlFrKCqCqUd9+BvXjut4hPSlOtx vixDGS4oHEXjmRt4iLXjoCmmFewgTAX316+Bt1zwcmHBt4d7icOm/801ufe8KjxDI9PvX ISrZU8sFZeihqi7n5ub2p+9y+opiGOqVAObrxyL1vbc+t0yFHRi+jCQutXEazCdpiuyvW ob2rpNUKy7kPXDit5M54CkDCQyT97Ld8rZkDKC+AWRgP2hEi0NaY8+lVbLu7WPjjRjw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793831248; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=0Y+dh6sJQSenVoeaw8ReMLOpBSyUyhyNDOulakBHOXU=; b=qNZqejBsDSA1AIenPZWtR7ZOzuryoFGMrhnF+5fGxxQV6m/JylV+RKv/CDz3l/B+5KuM OBWmNUWxm/71cjPCePsBuXPPsQvXKd1bShq9Dn4hqZjZMboqubMW0dDOVnR0qI82U4t58 B47TwyNYKyC+wC7nGg4km8faQFXuAgfzZEg/uUnb2yxvUq3D7MDEEXyKpbQw/SQ4bm4PL Ofee3mOcPT8mOs60yLRkmiRiFJMVU0XvjMq6vusBN9WFy7qhnLeDZe5vhoniIrv8eKIPm Fn826LNGnM73r9Eu75cCoADKmALgpU3i6KfuCfXrNpRt5WBQ8Geh2sz9DtqaVHzdpgg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=F7p+l9Ub; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB3D6606A33E; Wed, 4 Nov 2026 22:27:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=F7p+l9Ub Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F1AA1F00A15; Wed, 4 Nov 2026 22:27:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793831247; bh=0Y+dh6sJQSenVoeaw8ReMLOpBSyUyhyNDOulakBHOXU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=F7p+l9UbB+FQdDyYc1ekYBKFi9PF/7uEXQ3nE46SOPIeBJEBWFxR7eCu7TCOwpT6x iB9couZIKXJ881zXB3+v+x77GP3c2d1MbntC0jjblu+CAyL/eBT1rftd6ineHoYTot KF/1oloSD+jrlcuVHv4u7Nwy8GYidWD6KRErlD6o= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Namjae Jeon , Paulo Alcantara , David Howells , Tom Talpey , Shyam Prasad N , Ronnie Sahlberg , Bharath SM , Sasha Levin Subject: [PATCH 6.18 0587/1005] smb: client: fix fattr leaking on wsl_to_fattr() failure Date: Wed, 4 Nov 2026 16:05:20 -0500 Message-ID: <20261104211100.309800527@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261104211043.516122098@linuxfoundation.org> References: <20261104211043.516122098@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paulo Alcantara [ Upstream commit e1253a82bb4c0fed6706a5839fc8b6e01be1abe2 ] wsl_to_fattr() mutates fattr fields as it parses each WSL EA. If validation later fails, the function returns false with partially mutated fattr fields that callers do not reset. Fix this by parsing into local variables and only committing them to fattr on success. Closes: https://sashiko.dev/#/patchset/20260906200517.725015-1-pc%40manguebit.org Fixes: 78e26bec4d6d ("smb: client: parse uid, gid, mode and dev from WSL reparse points") Reviewed-by: Namjae Jeon Signed-off-by: Paulo Alcantara Cc: David Howells Cc: Tom Talpey Cc: Shyam Prasad N Cc: Ronnie Sahlberg Cc: Bharath SM Cc: Namjae Jeon Cc: stable@vger.kernel.org [ sashal: Reordered context in the first hunk: the three setup assignments appear in a different order, so I removed them and added the local mode initialization. ] Signed-off-by: Sasha Levin --- fs/smb/client/reparse.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c index 124ad21d6dff6..47c8413d9ed9d 100644 --- a/fs/smb/client/reparse.c +++ b/fs/smb/client/reparse.c @@ -1110,29 +1110,30 @@ static bool wsl_to_fattr(struct cifs_open_info_data *data, u32 tag, struct cifs_fattr *fattr) { unsigned int sbflags = cifs_sb_flags(cifs_sb); + kuid_t uid = cifs_sb->ctx->linux_uid; + kgid_t gid = cifs_sb->ctx->linux_gid; struct smb2_file_full_ea_info *ea; bool have_xattr_dev = false; + dev_t rdev = 0; + umode_t mode; u32 next = 0; - fattr->cf_mode &= ~S_IFMT; - fattr->cf_uid = cifs_sb->ctx->linux_uid; - fattr->cf_gid = cifs_sb->ctx->linux_gid; - + mode = fattr->cf_mode & ~S_IFMT; switch (tag) { case IO_REPARSE_TAG_LX_SYMLINK: - fattr->cf_mode |= S_IFLNK; + mode |= S_IFLNK; break; case IO_REPARSE_TAG_LX_FIFO: - fattr->cf_mode |= S_IFIFO; + mode |= S_IFIFO; break; case IO_REPARSE_TAG_AF_UNIX: - fattr->cf_mode |= S_IFSOCK; + mode |= S_IFSOCK; break; case IO_REPARSE_TAG_LX_CHR: - fattr->cf_mode |= S_IFCHR; + mode |= S_IFCHR; break; case IO_REPARSE_TAG_LX_BLK: - fattr->cf_mode |= S_IFBLK; + mode |= S_IFBLK; break; } @@ -1156,26 +1157,29 @@ static bool wsl_to_fattr(struct cifs_open_info_data *data, if (!strncmp(name, SMB2_WSL_XATTR_UID, nlen)) { if (!(sbflags & CIFS_MOUNT_OVERR_UID)) - fattr->cf_uid = wsl_make_kuid(cifs_sb, v); + uid = wsl_make_kuid(cifs_sb, v); } else if (!strncmp(name, SMB2_WSL_XATTR_GID, nlen)) { if (!(sbflags & CIFS_MOUNT_OVERR_GID)) - fattr->cf_gid = wsl_make_kgid(cifs_sb, v); + gid = wsl_make_kgid(cifs_sb, v); } else if (!strncmp(name, SMB2_WSL_XATTR_MODE, nlen)) { /* File type in reparse point tag and in xattr mode must match. */ - if (S_DT(fattr->cf_mode) != S_DT(get_unaligned_le32(v))) + if (S_DT(mode) != S_DT(get_unaligned_le32(v))) return false; - fattr->cf_mode = (umode_t)get_unaligned_le32(v); + mode = get_unaligned_le32(v); } else if (!strncmp(name, SMB2_WSL_XATTR_DEV, nlen)) { - fattr->cf_rdev = reparse_mkdev(v); + rdev = reparse_mkdev(v); have_xattr_dev = true; } } while (next); out: - /* Major and minor numbers for char and block devices are mandatory. */ if (!have_xattr_dev && (tag == IO_REPARSE_TAG_LX_CHR || tag == IO_REPARSE_TAG_LX_BLK)) return false; + fattr->cf_uid = uid; + fattr->cf_gid = gid; + fattr->cf_mode = mode; + fattr->cf_rdev = rdev; return true; } -- 2.53.0