* FAILED: patch "[PATCH] ksmbd: prevent stale data from being written by SMB2 WRITE" failed to apply to 6.1-stable tree
@ 2026-11-03 10:18 gregkh
2026-11-03 21:37 ` [PATCH 6.1.y] ksmbd: prevent stale data from being written by SMB2 WRITE requests Sasha Levin
0 siblings, 1 reply; 2+ messages in thread
From: gregkh @ 2026-11-03 10:18 UTC (permalink / raw)
To: linkinjeon; +Cc: stable
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x bc0e0f5ac1d7b044d403f859406b4b66d4b1ce9b
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026110352-entering-splice-bcab@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From bc0e0f5ac1d7b044d403f859406b4b66d4b1ce9b Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@kernel.org>
Date: Mon, 7 Sep 2026 13:35:51 +0900
Subject: [PATCH] ksmbd: prevent stale data from being written by SMB2 WRITE
requests
Initialize the compatibility byte in request buffers without zeroing
the entire allocation. Keep the one-byte compatibility exception for
SMB2 messages so valid zero-length WRITE requests remain compatible,
and validate the data range in the WRITE handlers against the current
compound request before accessing it.
This prevents stale request-buffer data from being written to files or
sent to IPC pipes.
Fixes: 443d61d1fa9f ("ksmbd: allocate one more byte for implied bcc[0]")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-32436
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
diff --git a/fs/smb/server/compress.c b/fs/smb/server/compress.c
index 5162fb84c755..3fcb3e44302e 100644
--- a/fs/smb/server/compress.c
+++ b/fs/smb/server/compress.c
@@ -65,6 +65,7 @@ static int __ksmbd_decompress_request(struct ksmbd_conn *conn,
return -ENOMEM;
*(__be32 *)out = cpu_to_be32(out_size);
+ out[out_size + 4] = 0;
rc = smb_compression_decompress(conn->compress_algorithm,
conn->compress_chained,
conn->compress_pattern,
diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c
index d211861ff86f..3f8cc4998da5 100644
--- a/fs/smb/server/connection.c
+++ b/fs/smb/server/connection.c
@@ -752,6 +752,7 @@ int ksmbd_conn_handler_loop(void *p)
if (!conn->request_buf)
break;
+ conn->request_buf[pdu_size + 4] = 0;
memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
/*
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 18602a4759c0..c792ed5ebbd3 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -9276,23 +9276,25 @@ static noinline int smb2_write_pipe(struct ksmbd_work *work)
int err = 0, ret = 0;
char *data_buf;
size_t length;
+ unsigned int data_offset, req_len;
WORK_BUFFERS(work, req, rsp);
length = le32_to_cpu(req->Length);
id = req->VolatileFileId;
+ data_offset = le16_to_cpu(req->DataOffset);
+ req_len = smb2_current_req_len(work, &req->hdr);
- if ((u64)le16_to_cpu(req->DataOffset) + length >
- get_rfc1002_len(work->request_buf)) {
- pr_err("invalid write data offset %u, smb_len %u\n",
- le16_to_cpu(req->DataOffset),
- get_rfc1002_len(work->request_buf));
+ if (data_offset < offsetof(struct smb2_write_req, Buffer) ||
+ data_offset > req_len || length > req_len - data_offset) {
+ pr_err("invalid write data offset %u, length %zu, req_len %u\n",
+ data_offset, length, req_len);
err = -EINVAL;
goto out;
}
data_buf = (char *)(((char *)&req->hdr.ProtocolId) +
- le16_to_cpu(req->DataOffset));
+ data_offset);
rpc_resp = ksmbd_rpc_write(work->sess, id, data_buf, length);
if (rpc_resp) {
@@ -9579,14 +9581,21 @@ int smb2_write(struct ksmbd_work *work)
writethrough = true;
if (is_rdma_channel == false) {
- if (le16_to_cpu(req->DataOffset) <
- offsetof(struct smb2_write_req, Buffer)) {
+ unsigned int data_offset = le16_to_cpu(req->DataOffset);
+ unsigned int req_len = smb2_current_req_len(work, &req->hdr);
+
+ if (data_offset < offsetof(struct smb2_write_req, Buffer) ||
+ data_offset > req_len ||
+ length > req_len - data_offset) {
+ ksmbd_debug(SMB,
+ "invalid write data offset %u, length %zu, req_len %u\n",
+ data_offset, length, req_len);
err = -EINVAL;
goto out;
}
data_buf = (char *)(((char *)&req->hdr.ProtocolId) +
- le16_to_cpu(req->DataOffset));
+ data_offset);
ksmbd_debug(SMB, "filename %pD, offset %lld, len %zu\n",
fp->filp, offset, length);
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [PATCH 6.1.y] ksmbd: prevent stale data from being written by SMB2 WRITE requests
2026-11-03 10:18 FAILED: patch "[PATCH] ksmbd: prevent stale data from being written by SMB2 WRITE" failed to apply to 6.1-stable tree gregkh
@ 2026-11-03 21:37 ` Sasha Levin
0 siblings, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2026-11-03 21:37 UTC (permalink / raw)
To: stable; +Cc: Namjae Jeon, zdi-disclosures, Sasha Levin
From: Namjae Jeon <linkinjeon@kernel.org>
[ Upstream commit bc0e0f5ac1d7b044d403f859406b4b66d4b1ce9b ]
Initialize the compatibility byte in request buffers without zeroing
the entire allocation. Keep the one-byte compatibility exception for
SMB2 messages so valid zero-length WRITE requests remain compatible,
and validate the data range in the WRITE handlers against the current
compound request before accessing it.
This prevents stale request-buffer data from being written to files or
sent to IPC pipes.
Fixes: 443d61d1fa9f ("ksmbd: allocate one more byte for implied bcc[0]")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-32436
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
[ sashal: replaced smb2_current_req_len() calls with inline calculations using NextCommand or the remaining request buffer length ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/connection.c | 1 +
fs/smb/server/smb2pdu.c | 34 +++++++++++++++++++++++++---------
2 files changed, 26 insertions(+), 9 deletions(-)
diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c
index 168292f73a843..28c60d3070a25 100644
--- a/fs/smb/server/connection.c
+++ b/fs/smb/server/connection.c
@@ -403,6 +403,7 @@ int ksmbd_conn_handler_loop(void *p)
if (!conn->request_buf)
break;
+ conn->request_buf[pdu_size + 4] = 0;
memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
/*
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 8d2f5e4e9ae3b..250fb3d0a4c64 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -6683,23 +6683,28 @@ static noinline int smb2_write_pipe(struct ksmbd_work *work)
int err = 0, ret = 0;
char *data_buf;
size_t length;
+ unsigned int data_offset, req_len;
WORK_BUFFERS(work, req, rsp);
length = le32_to_cpu(req->Length);
id = req->VolatileFileId;
+ data_offset = le16_to_cpu(req->DataOffset);
+ req_len = le32_to_cpu(req->hdr.NextCommand);
+ if (!req_len)
+ req_len = get_rfc1002_len(work->request_buf) -
+ work->next_smb2_rcv_hdr_off;
- if ((u64)le16_to_cpu(req->DataOffset) + length >
- get_rfc1002_len(work->request_buf)) {
- pr_err("invalid write data offset %u, smb_len %u\n",
- le16_to_cpu(req->DataOffset),
- get_rfc1002_len(work->request_buf));
+ if (data_offset < offsetof(struct smb2_write_req, Buffer) ||
+ data_offset > req_len || length > req_len - data_offset) {
+ pr_err("invalid write data offset %u, length %zu, req_len %u\n",
+ data_offset, length, req_len);
err = -EINVAL;
goto out;
}
data_buf = (char *)(((char *)&req->hdr.ProtocolId) +
- le16_to_cpu(req->DataOffset));
+ data_offset);
rpc_resp = ksmbd_rpc_write(work->sess, id, data_buf, length);
if (rpc_resp) {
@@ -6850,14 +6855,25 @@ int smb2_write(struct ksmbd_work *work)
writethrough = true;
if (is_rdma_channel == false) {
- if (le16_to_cpu(req->DataOffset) <
- offsetof(struct smb2_write_req, Buffer)) {
+ unsigned int data_offset = le16_to_cpu(req->DataOffset);
+ unsigned int req_len = le32_to_cpu(req->hdr.NextCommand);
+
+ if (!req_len)
+ req_len = get_rfc1002_len(work->request_buf) -
+ work->next_smb2_rcv_hdr_off;
+
+ if (data_offset < offsetof(struct smb2_write_req, Buffer) ||
+ data_offset > req_len ||
+ length > req_len - data_offset) {
+ ksmbd_debug(SMB,
+ "invalid write data offset %u, length %zu, req_len %u\n",
+ data_offset, length, req_len);
err = -EINVAL;
goto out;
}
data_buf = (char *)(((char *)&req->hdr.ProtocolId) +
- le16_to_cpu(req->DataOffset));
+ data_offset);
ksmbd_debug(SMB, "filename %pD, offset %lld, len %zu\n",
fp->filp, offset, length);
--
2.53.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-03 21:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-03 10:18 FAILED: patch "[PATCH] ksmbd: prevent stale data from being written by SMB2 WRITE" failed to apply to 6.1-stable tree gregkh
2026-11-03 21:37 ` [PATCH 6.1.y] ksmbd: prevent stale data from being written by SMB2 WRITE requests Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox