From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793817018; b=KoDZ8a8J1oUfIcSOGMj4bXB00muJHsHvotrwscBWUZ2eOtwcP90lpTVZRCFckPyeuIDA CzneVzY/LeQWkd6L3UpcHdsaH7diKDjZuGKjmdfyYPAIRPODlf8z/S9ggfwyBV1fm1vl/ U1Kw7YJh5VFj41cW0gRkp9D8pSbzeHciZJWIqouS19FvfV0CUWCBw0mwH3N8U9r1sBehO XGInbhe0eZ0bjhTGN0rETjZCclJe9GkNa+5NgmXOI+NjbZNbDg2WM1X6hczDlZWsFYcul JlkLNTMr6MlChsk2mnnn1tWNZ84q5LPZqYC63j07pl/mpB6IQxlQFL3GXSOvAvzKrSA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793817018; h=Received:DKIM-Signature:Subject:To:Cc:From:Date:Message-ID: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=AUGwWIx/pwGEyhR0ayrslku3hb6RiL8djhrMXkVJLq4=; b=EGL2iBVVkGR8dyfwWrB/mmCn9oIPUzooFZ7wFdGinoQS9/2avW4WMCJ89Q8n2YZi0QDD mQQ/S1KEZ16yFiRnxpHtZO/VJv7zWZQhfXOlppT0LbNrfY4UZGA7OFz22RBcfet1G/SeJ 3nMOnBGM6Ujps2QtV4GpvtTVjo8+3ofwV5rWTEeVHB+YynYdQ3JX+Ttm+CPr2hepWha6Q UmXRzbArVk8UABGDdM2HQl/1TIGAniBkpMwGh2IRtjudeWMJyG3i1/d60VqKgmrtvgnVL 1gI9cKex22KFlR8q9UPOLsbvi+VaWSWmQJ1wwO5xyGMFpbPTHuqpxNGkzGUAcIjPZlQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=G2IeSH74; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 53680606A32D for ; Wed, 4 Nov 2026 18:30:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=G2IeSH74 Received: by smtp.kernel.org (Postfix) with ESMTPSA id D381F1F000C1; Wed, 4 Nov 2026 18:30:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793817017; bh=AUGwWIx/pwGEyhR0ayrslku3hb6RiL8djhrMXkVJLq4=; h=Subject:To:Cc:From:Date; b=G2IeSH74Btt3u/NA/BcR9wmvUJkZB2IOIKE0HfoaiIAq3xE4UWFHbp8MC8J2KVYoL e4169QqzleEl5IPV+Z+1xuseks812ZJ8MpFXr+f1C34PMfCAHt50L6dXTNw6cxSzsZ U+KeXGH0/wQgsnrQQFeoDNIQJED0WXaKfr8cUd34= Subject: FAILED: patch "[PATCH] smb: client: bound POSIX lock data area by response length" failed to apply to 5.10-stable tree To: ratnaker.gautam@kuleuven.be,linkinjeon@kernel.org,pc@manguebit.org Cc: From: Date: Wed, 04 Nov 2026 13:30:08 -0500 Message-ID: <2026110408-eatery-delta-feb8@gregkh> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 8fc9af68c57156ff64769f30e831553cd03b3000 # git commit -s git send-email --to '' --in-reply-to '2026110408-eatery-delta-feb8@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 8fc9af68c57156ff64769f30e831553cd03b3000 Mon Sep 17 00:00:00 2001 From: Ratnaker Gautam Date: Sun, 18 Oct 2026 00:49:33 +0200 Subject: [PATCH] smb: client: bound POSIX lock data area by response length CIFSSMBPosixLock() receives a TRANS2 response whose server-provided DataOffset and DataCount are not required by validate_t2() to describe an interval inside the response. A server can therefore make the client read a cifs_posix_lock beyond the response buffer and return those kernel bytes through F_GETLK. Use smbCalcSize() to obtain the full response length after any multipart TRANS2 reassembly, then reject data areas that extend past it before dereferencing them. Fixes: fc94cdb94462 ("[CIFS] Fix new POSIX Locking for setting lock_type correctly on unlock") Reported-by: Ratnaker Gautam Cc: stable@vger.kernel.org Signed-off-by: Ratnaker Gautam Reviewed-by: Namjae Jeon Signed-off-by: Paulo Alcantara diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c index 50ca062a22bf..e335686a68f2 100644 --- a/fs/smb/client/cifssmb.c +++ b/fs/smb/client/cifssmb.c @@ -2369,6 +2369,7 @@ CIFSSMBPosixLock(const unsigned int xid, struct cifs_tcon *tcon, cifs_dbg(FYI, "Send error in Posix Lock = %d\n", rc); } else if (pLockData) { /* lock structure can be returned on get */ + unsigned int rsp_len; __u16 data_offset; __u16 data_count; rc = validate_t2((struct smb_t2_rsp *)pSMBr); @@ -2380,11 +2381,18 @@ CIFSSMBPosixLock(const unsigned int xid, struct cifs_tcon *tcon, } data_offset = le16_to_cpu(pSMBr->t2.DataOffset); data_count = le16_to_cpu(pSMBr->t2.DataCount); + rsp_len = smbCalcSize(&pSMBr->hdr); if (data_count < sizeof(struct cifs_posix_lock)) { rc = smb_EIO2(smb_eio_trace_lock_data_too_small, data_count, sizeof(struct cifs_posix_lock)); goto plk_err_exit; } + if (data_offset > rsp_len || + data_count > rsp_len - data_offset) { + rc = smb_EIO2(smb_eio_trace_lock_data_area, + data_offset, data_count); + goto plk_err_exit; + } parm_data = (struct cifs_posix_lock *) ((char *)&pSMBr->hdr.Protocol + data_offset); if (parm_data->lock_type == cpu_to_le16(CIFS_UNLCK)) diff --git a/fs/smb/client/trace.h b/fs/smb/client/trace.h index 2708bedb49ab..5331ce6dc8b3 100644 --- a/fs/smb/client/trace.h +++ b/fs/smb/client/trace.h @@ -44,6 +44,7 @@ EM(smb_eio_trace_ioctl_no_rsp, "ioctl_no_rsp") \ EM(smb_eio_trace_ioctl_out_off, "ioctl_out_off") \ EM(smb_eio_trace_lock_bcc_too_small, "lock_bcc_too_small") \ + EM(smb_eio_trace_lock_data_area, "lock_data_area") \ EM(smb_eio_trace_lock_data_too_small, "lock_data_too_small") \ EM(smb_eio_trace_malformed_ksid_key, "malformed_ksid_key") \ EM(smb_eio_trace_malformed_sid_key, "malformed_sid_key") \