* FAILED: patch "[PATCH] smb: client: do not pass a NULL buf to is_oplock_break()" failed to apply to 6.1-stable tree
@ 2026-11-02 15:30 gregkh
2026-11-03 2:22 ` [PATCH 6.1.y] smb: client: do not pass a NULL buf to is_oplock_break() Sasha Levin
0 siblings, 1 reply; 2+ messages in thread
From: gregkh @ 2026-11-02 15:30 UTC (permalink / raw)
To: 2715417602, dhowells, pc; +Cc: stable
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 2225ab306575e424b3dad2ee1be2521c89249d15
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026110215-underpay-cassette-20d6@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 2225ab306575e424b3dad2ee1be2521c89249d15 Mon Sep 17 00:00:00 2001
From: Zikang Gao <2715417602@qq.com>
Date: Wed, 14 Oct 2026 04:19:44 -0400
Subject: [PATCH] smb: client: do not pass a NULL buf to is_oplock_break()
receive_encrypted_read() sets *num_mids = 1 and never writes the
caller's bufs[]. Offload returns -1 with *num_mids = 0, so the
demultiplex thread skips the frame. The inline decrypt path
returns 0 even when smb2_find_mid() fails.
cifs_demultiplex_thread() then treats mids[i] == NULL as an
oplock break and calls is_oplock_break(bufs[i], server) with
bufs[i] still NULL. smb2_is_valid_oplock_break() reads
hdr.Command at offset 12 and oopses.
A large encrypted READ whose MessageId does not match is enough
to panic cifsd.
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000001: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range
[0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 100 Comm: cifsd
RIP: smb2_is_valid_oplock_break+0xc8/0x2270 [cifs]
cifs_demultiplex_thread
Kernel panic - not syncing: Fatal exception
Return -1 when inline decrypt finds no mid, and skip
is_oplock_break() plus the unknown-frame dump when bufs[i]
is NULL. receive_encrypted_standard() already assigns
bufs[*num_mids].
Fixes: c42a6abe3012 ("CIFS: Add capability to decrypt big read responses")
Assisted-by: LLM
Signed-off-by: Zikang Gao <2715417602@qq.com>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: stable@vger.kernel.org
diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index 550e687a1b15..f46c37e9b3c7 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -1422,12 +1422,14 @@ cifs_demultiplex_thread(void *p)
mid_execute_callback(server, mids[i]);
release_mid(server, mids[i]);
- } else if (server->ops->is_oplock_break &&
+ } else if (bufs[i] && server->ops->is_oplock_break &&
server->ops->is_oplock_break(bufs[i],
server)) {
smb2_add_credits_from_hdr(bufs[i], server);
cifs_dbg(FYI, "Received oplock break\n");
} else {
+ if (!bufs[i])
+ continue;
cifs_server_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n",
atomic_read(&mid_count));
cifs_dump_mem("Received Data is: ", bufs[i],
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index 207aa2c6acf4..a0b9363ba89d 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -5396,6 +5396,7 @@ receive_encrypted_read(struct TCP_Server_Info *server, struct mid_q_entry **mid,
*mid = smb2_find_mid(server, buf);
if (*mid == NULL) {
cifs_dbg(FYI, "mid not found\n");
+ rc = -1;
} else {
cifs_dbg(FYI, "mid found\n");
(*mid)->decrypted = true;
^ permalink raw reply related [flat|nested] 2+ messages in thread* [PATCH 6.1.y] smb: client: do not pass a NULL buf to is_oplock_break()
2026-11-02 15:30 FAILED: patch "[PATCH] smb: client: do not pass a NULL buf to is_oplock_break()" failed to apply to 6.1-stable tree gregkh
@ 2026-11-03 2:22 ` Sasha Levin
0 siblings, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2026-11-03 2:22 UTC (permalink / raw)
To: stable; +Cc: Zikang Gao, David Howells, Paulo Alcantara, Sasha Levin
From: Zikang Gao <2715417602@qq.com>
[ Upstream commit 2225ab306575e424b3dad2ee1be2521c89249d15 ]
receive_encrypted_read() sets *num_mids = 1 and never writes the
caller's bufs[]. Offload returns -1 with *num_mids = 0, so the
demultiplex thread skips the frame. The inline decrypt path
returns 0 even when smb2_find_mid() fails.
cifs_demultiplex_thread() then treats mids[i] == NULL as an
oplock break and calls is_oplock_break(bufs[i], server) with
bufs[i] still NULL. smb2_is_valid_oplock_break() reads
hdr.Command at offset 12 and oopses.
A large encrypted READ whose MessageId does not match is enough
to panic cifsd.
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000001: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range
[0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 100 Comm: cifsd
RIP: smb2_is_valid_oplock_break+0xc8/0x2270 [cifs]
cifs_demultiplex_thread
Kernel panic - not syncing: Fatal exception
Return -1 when inline decrypt finds no mid, and skip
is_oplock_break() plus the unknown-frame dump when bufs[i]
is NULL. receive_encrypted_standard() already assigns
bufs[*num_mids].
Fixes: c42a6abe3012 ("CIFS: Add capability to decrypt big read responses")
Assisted-by: LLM
Signed-off-by: Zikang Gao <2715417602@qq.com>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: stable@vger.kernel.org
[ sashal: added braces around the existing NULL-MID branch to include the new assignment ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/connect.c | 4 +++-
fs/smb/client/smb2ops.c | 5 +++--
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index 157d947846d9b..f765246fa57c7 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -1324,12 +1324,14 @@ cifs_demultiplex_thread(void *p)
mids[i]->callback(mids[i]);
release_mid(mids[i]);
- } else if (server->ops->is_oplock_break &&
+ } else if (bufs[i] && server->ops->is_oplock_break &&
server->ops->is_oplock_break(bufs[i],
server)) {
smb2_add_credits_from_hdr(bufs[i], server);
cifs_dbg(FYI, "Received oplock break\n");
} else {
+ if (!bufs[i])
+ continue;
cifs_server_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n",
atomic_read(&mid_count));
cifs_dump_mem("Received Data is: ", bufs[i],
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index a7b884e8c3412..ab7ed90d6fb2b 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -5219,9 +5219,10 @@ receive_encrypted_read(struct TCP_Server_Info *server, struct mid_q_entry **mid,
goto free_pages;
*mid = smb2_find_mid(server, buf);
- if (*mid == NULL)
+ if (*mid == NULL) {
cifs_dbg(FYI, "mid not found\n");
- else {
+ rc = -1;
+ } else {
cifs_dbg(FYI, "mid found\n");
(*mid)->decrypted = true;
rc = handle_read_data(server, *mid, buf,
--
2.53.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-03 2:22 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-02 15:30 FAILED: patch "[PATCH] smb: client: do not pass a NULL buf to is_oplock_break()" failed to apply to 6.1-stable tree gregkh
2026-11-03 2:22 ` [PATCH 6.1.y] smb: client: do not pass a NULL buf to is_oplock_break() Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox