From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793633420; b=XyFk8HLget6IRXOUZ0jj1Xhn8XIX9BTMvH3M0SKr1rJclQZ+uIavEwl6SqBdi1g8/1wV hksw/o/E/oLc79fj+WCObfevezhUGBG4uOTsYhdUdkVZMGyjlbcPpq++H3und4A0Mc+rU DtM7D2z7g31KLqhpDZoDVjFs6Tc7OswO3FiT9oQQHzEv/PUehVX9f4kJc0AAUjqgUTcJS 3Eu/stJPC+9EesQ71Ybj0cbt+3N6jMCxYMvbm6E9RrVTm/122kLmIdenu+sof0Kr+S1Zh ov1nxldV8ZCijp8qtsEGjmP1SV1bgZ7fUXK4QrB5pqebtrDBvVG7Wh+9nsJoDQG7fnA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793633420; h=Received:DKIM-Signature:Subject:To:Cc:From:Date:Message-ID: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=Yb3QpiGgzBvBJfa+iI88Xz/otuXNurHHNqxlmIrKat4=; b=jrrXAScPBSM1w8f6s+yLG/LDzxEusZBWD2sN2to4sOmLNY1LGJH0Fo/yQXnQLzReBfVm OmE6BOD7gQIFtPaRAU+0iW3N6p7PT/EiIv5pBpz0GBXLBpbLoP8mt8v+hu9r/w7ilMelz 5WoXuayPLyEak653QWuYZH++Qo2WTzrCOoHBpx6bAHzkgBzOfjXc9TheBZLDov0bYXlbk NFz2vQWrZ552j5TIJt72xKGPnFT7DZoafAcriUqD/apnx/L0eNoqmvygoBJj4V5Qu1FR6 fwCdhgDgDlo975fAOuOPih0VQTL2wDc3avimQ5V+Mcy5t/x3PTGUvt8RmSaAOCehM1w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=qVbQcGwt; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 46E17606A93A for ; Mon, 2 Nov 2026 15:30:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=qVbQcGwt Received: by smtp.kernel.org (Postfix) with ESMTPSA id A16E01F00A23; Mon, 2 Nov 2026 15:30:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793633419; bh=Yb3QpiGgzBvBJfa+iI88Xz/otuXNurHHNqxlmIrKat4=; h=Subject:To:Cc:From:Date; b=qVbQcGwtTGsae+FspPckpr3DMYShXo5Cmgv3onZqJyF/BOZwNPXmwtmurSX2OOXV8 SrzlhpjQwfJdmp22B5VATY+VXh06KtHE3RuNby56d5VqGQNClMiXUYGUrP7A0cLq0n NkD3EtxspW3xoeuRKe093AuAaUyu21GaV3WiN0kE= Subject: FAILED: patch "[PATCH] smb: client: do not pass a NULL buf to is_oplock_break()" failed to apply to 6.1-stable tree To: 2715417602@qq.com,dhowells@redhat.com,pc@manguebit.org Cc: From: Date: Mon, 02 Nov 2026 16:30:15 +0100 Message-ID: <2026110215-underpay-cassette-20d6@gregkh> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.1-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y git checkout FETCH_HEAD git cherry-pick -x 2225ab306575e424b3dad2ee1be2521c89249d15 # git commit -s git send-email --to '' --in-reply-to '2026110215-underpay-cassette-20d6@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 2225ab306575e424b3dad2ee1be2521c89249d15 Mon Sep 17 00:00:00 2001 From: Zikang Gao <2715417602@qq.com> Date: Wed, 14 Oct 2026 04:19:44 -0400 Subject: [PATCH] smb: client: do not pass a NULL buf to is_oplock_break() receive_encrypted_read() sets *num_mids = 1 and never writes the caller's bufs[]. Offload returns -1 with *num_mids = 0, so the demultiplex thread skips the frame. The inline decrypt path returns 0 even when smb2_find_mid() fails. cifs_demultiplex_thread() then treats mids[i] == NULL as an oplock break and calls is_oplock_break(bufs[i], server) with bufs[i] still NULL. smb2_is_valid_oplock_break() reads hdr.Command at offset 12 and oopses. A large encrypted READ whose MessageId does not match is enough to panic cifsd. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 100 Comm: cifsd RIP: smb2_is_valid_oplock_break+0xc8/0x2270 [cifs] cifs_demultiplex_thread Kernel panic - not syncing: Fatal exception Return -1 when inline decrypt finds no mid, and skip is_oplock_break() plus the unknown-frame dump when bufs[i] is NULL. receive_encrypted_standard() already assigns bufs[*num_mids]. Fixes: c42a6abe3012 ("CIFS: Add capability to decrypt big read responses") Assisted-by: LLM Signed-off-by: Zikang Gao <2715417602@qq.com> Reviewed-by: David Howells Signed-off-by: Paulo Alcantara Cc: stable@vger.kernel.org diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c index 550e687a1b15..f46c37e9b3c7 100644 --- a/fs/smb/client/connect.c +++ b/fs/smb/client/connect.c @@ -1422,12 +1422,14 @@ cifs_demultiplex_thread(void *p) mid_execute_callback(server, mids[i]); release_mid(server, mids[i]); - } else if (server->ops->is_oplock_break && + } else if (bufs[i] && server->ops->is_oplock_break && server->ops->is_oplock_break(bufs[i], server)) { smb2_add_credits_from_hdr(bufs[i], server); cifs_dbg(FYI, "Received oplock break\n"); } else { + if (!bufs[i]) + continue; cifs_server_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n", atomic_read(&mid_count)); cifs_dump_mem("Received Data is: ", bufs[i], diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 207aa2c6acf4..a0b9363ba89d 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -5396,6 +5396,7 @@ receive_encrypted_read(struct TCP_Server_Info *server, struct mid_q_entry **mid, *mid = smb2_find_mid(server, buf); if (*mid == NULL) { cifs_dbg(FYI, "mid not found\n"); + rc = -1; } else { cifs_dbg(FYI, "mid found\n"); (*mid)->decrypted = true;