From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D15F750AC0E; Wed, 30 Sep 2026 17:21:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790788879; cv=none; b=SsQ2gY+vSGq3sNodu81L9N8u2CKuo7BcUp1MrdBDgVQ9Z83WdYChIJ3HJctRIJN9G3e568sfJAMh7VqEELyLiJmr5QtyG4YU5qL7cMn4uzxGNGSCvBjPie5tntdULtkTvCqrgEYpyxoFlTjPUYCf3xSbdfu1Gq+Whd/MG22uStg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790788879; c=relaxed/simple; bh=fSc9SsedsBQtO/SFMKIpyb4NKog2EG148CzVZ30q3xk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KFlVXT34FSiZgnM5SK68yW3pAiZJxTHMKzMxrGslsVqc4EahM7mQvm6wR7XH4ItsSi838HWstXmZxsRNaGGN7gCUF49p+sLLqcFwpV5Nj83KLVgjgBzeYUWzOsbgYp6lv+ve98uS969Q1D3NeD0Ao8431VmyfTnzlevizb1mKQw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=nbpeR9Kg; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="nbpeR9Kg" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E5FD1F000FF; Wed, 30 Sep 2026 17:21:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790788877; bh=O8HNsxdT3b3Zev5oL1YZpNQVATzmDrX85j4KXZ2NWto=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=nbpeR9KgEVzQhZX4YqNPrWBIUjO6xZy6mmolVAyOFfhHGXreN7U1AJSrOJ5LdEyOg /XoRbrFQa8PXFD59Cb756UoJd53ffUZC7tS9JEnbivGnqcUCWqFf/AzF/jKDWFKuQ9 AXhxeoaXC8K79b7DNidOCS1asyNJAoQtubLC/TOw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Namjae Jeon , Paulo Alcantara , David Howells , Tom Talpey , Shyam Prasad N , Ronnie Sahlberg , Bharath SM Subject: [PATCH 6.12 280/877] smb: client: fix unaligned access in WSL reparse point parser Date: Wed, 30 Sep 2026 17:19:51 +0200 Message-ID: <20260930152420.759934956@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260930152414.738996857@linuxfoundation.org> References: <20260930152414.738996857@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paulo Alcantara commit e1aeaf79dea51e6065da56924bc07e22d59012ac upstream. When wsl_to_fattr() parses WSL extended attributes, it computes a payload pointer from ea->ea_data + ea_name_length + 1. Since the smb2_file_full_ea_info struct is __packed and all WSL xattr names are 6 bytes long, the value pointer always lands at an odd byte offset, never satisfying __le32 or __le64 alignment requirements. The code then casts this pointer to __le32 * or __le64 * and dereferences it directly, which may cause alignment faults on some architectures. Replace all such casts with get_unaligned_le32() and get_unaligned_le64() in reparse_mkdev(), wsl_make_kuid(), wsl_make_kgid() and wsl_to_fattr(). Closes: https://sashiko.dev/#/patchset/20260906200517.725015-1-pc%40manguebit.org Fixes: 78e26bec4d6d ("smb: client: parse uid, gid, mode and dev from WSL reparse points") Reviewed-by: Namjae Jeon Signed-off-by: Paulo Alcantara Cc: David Howells Cc: Tom Talpey Cc: Shyam Prasad N Cc: Ronnie Sahlberg Cc: Bharath SM Cc: Namjae Jeon Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- fs/smb/client/reparse.c | 4 ++-- fs/smb/client/reparse.h | 7 ++++--- 2 files changed, 6 insertions(+), 5 deletions(-) --- a/fs/smb/client/reparse.c +++ b/fs/smb/client/reparse.c @@ -726,9 +726,9 @@ static bool wsl_to_fattr(struct cifs_ope fattr->cf_gid = wsl_make_kgid(cifs_sb, v); else if (!strncmp(name, SMB2_WSL_XATTR_MODE, nlen)) { /* File type in reparse point tag and in xattr mode must match. */ - if (S_DT(fattr->cf_mode) != S_DT(le32_to_cpu(*(__le32 *)v))) + if (S_DT(fattr->cf_mode) != S_DT(get_unaligned_le32(v))) return false; - fattr->cf_mode = (umode_t)le32_to_cpu(*(__le32 *)v); + fattr->cf_mode = (umode_t)get_unaligned_le32(v); } else if (!strncmp(name, SMB2_WSL_XATTR_DEV, nlen)) { fattr->cf_rdev = reparse_mkdev(v); have_xattr_dev = true; --- a/fs/smb/client/reparse.h +++ b/fs/smb/client/reparse.h @@ -9,6 +9,7 @@ #include #include #include +#include #include "fs_context.h" #include "cifsglob.h" @@ -22,7 +23,7 @@ static inline dev_t reparse_mkdev(void *ptr) { - u64 v = le64_to_cpu(*(__le64 *)ptr); + u64 v = get_unaligned_le64(ptr); return MKDEV(v & 0xffffffff, v >> 32); } @@ -30,7 +31,7 @@ static inline dev_t reparse_mkdev(void * static inline kuid_t wsl_make_kuid(struct cifs_sb_info *cifs_sb, void *ptr) { - u32 uid = le32_to_cpu(*(__le32 *)ptr); + u32 uid = get_unaligned_le32(ptr); if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_UID) return cifs_sb->ctx->linux_uid; @@ -40,7 +41,7 @@ static inline kuid_t wsl_make_kuid(struc static inline kgid_t wsl_make_kgid(struct cifs_sb_info *cifs_sb, void *ptr) { - u32 gid = le32_to_cpu(*(__le32 *)ptr); + u32 gid = get_unaligned_le32(ptr); if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_OVERR_GID) return cifs_sb->ctx->linux_gid;