From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793820275; b=VDjPpPf+WrMT4Jcr6VtROMVmwlZsmo6JvOernirSEWzIGxqC4HjeyPw/LpKM6rwmmexJ X7MLlr2WOSYuNjw4xYHHIzoSVAFX8/TM1e6H2bnuyc299tmBWUx1+0jydzB7iKRJNKDe8 nDkDKqkFdQfFC425K0cX8VVNW0oto74VdOXPrnKtTcbP0k10dkDF0i9NL9amuaSGcAto3 n8MezKK6dlQzNJrPRAB2t+WAo7tq93z+aDHg/9GJx/PsIAfGTXDL/cvjgVX7GVdTkG+pe K7veIZpCCrLJd4yT8jhO9JAQY5qSL0ije7MxS9KIhMreSHnqpuCNNaEJLAsVti56Z3w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793820275; h=Received:DKIM-Signature:Date:From:To:Cc:Subject:Message-ID: References:MIME-Version:Content-Type:Content-Disposition:In-Reply-To; bh=5nxOtkxaoePuxBf6a57J1wPX3IncScFUviCmEEDJktw=; b=LTWCSfNggjxzd5s/sk63AG/UbDSmi7D9kSw4NemDMaBHiD6lmJhTCscLYxkEyj6dQVxH Le3NMHDS5AmphGkSaBKFucc0lZJmfkM2GZ2wAOZEau6Ean8vrf59bq+GnaquR9euI33wn egXLWpsChOlOltnFDWMdlzA0qqXeTJ6rTFe8tRYmtm0wFZExq9sBjJ89wJ8U84oMnk2jv izLo8ToD4tDyde/AVXE+D71mLBnou9MN+gRiNEtNWB2ydF0iNeug6uyl6ZWvnWW4gZ7fg fEd7z9FFagib3pXFsebsoPBjrXorcfcDiV1hTUqXeOppPsBNHx2v3Jy9NlZV+vFGcSg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=bMMmq1Fp; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 357BF607CCAD for ; Wed, 4 Nov 2026 19:24:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=bMMmq1Fp Received: by smtp.kernel.org (Postfix) with ESMTPSA id AC4721F000C1; Wed, 4 Nov 2026 19:24:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793820274; bh=5nxOtkxaoePuxBf6a57J1wPX3IncScFUviCmEEDJktw=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=bMMmq1FpWRadNmEvOmDK3dTEv34a0ni0sVEj1/v4vRXOv04BkRGL5ms/DpjXilZ+F LTcUjEi8ejbBKNp/VOkMcvQK8ycTdZ8XTWnMrK5wxWIO09vdqbtnz6GBrSkI02EN6z 1HRmcvGgTa+tYIWoLaISjGl9wo4ihKmxTMGY89lU= Date: Wed, 4 Nov 2026 14:24:33 -0500 From: Greg KH To: Stefan Metzmacher Cc: linkinjeon@kernel.org, stable@vger.kernel.org Subject: Re: FAILED: patch "[PATCH] smb: smbdirect: fix buffer length underflow in RDMA transfers" failed to apply to 6.18-stable tree Message-ID: <2026110423-sediment-landing-8a9d@gregkh> References: <2026110436-thee-asleep-2059@gregkh> <456026fe-5cf5-4a35-bf82-75d5ed652846@samba.org> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <456026fe-5cf5-4a35-bf82-75d5ed652846@samba.org> On Wed, Nov 04, 2026 at 08:12:22PM +0100, Stefan Metzmacher wrote: > Am 04.11.26 um 19:29 schrieb gregkh@linuxfoundation.org: > > > > The patch below does not apply to the 6.18-stable tree. > > If someone wants it applied there, or to any other stable or longterm > > tree, then please email the backport, including the original git commit > > id to . > > > > To reproduce the conflict and resubmit, you may use the following commands: > > > > git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y > > git checkout FETCH_HEAD > > git cherry-pick -x 7193241a49c958782ba4b8df06da3734d1e317d2 > > # > > git commit -s > > git send-email --to '' --in-reply-to '2026110436-thee-asleep-2059@gregkh' --subject-prefix 'PATCH 6.18.y' 'HEAD^..' > > > > Possible dependencies: > > > > > > > > thanks, > > > > greg k-h > > > > ------------------ original commit in Linus's tree ------------------ > > > > From 7193241a49c958782ba4b8df06da3734d1e317d2 Mon Sep 17 00:00:00 2001 > > From: Stefan Metzmacher > > Date: Fri, 23 Oct 2026 19:26:09 +0900 > > Subject: [PATCH] smb: smbdirect: fix buffer length underflow in RDMA transfers > > > > When a remote buffer descriptor is larger than the remaining local > > buffer, smbdirect_connection_rdma_xmit() clamps its length and sets > > buf_len to zero. The common accounting code then subtracts the clamped > > length from buf_len, causing it to underflow. If another descriptor > > follows, the loop processes it with a wrapped remaining length and > > includes memory beyond the local buffer in the RDMA transfer. > > > > A client can trigger an out-of-bounds kernel write with an SMB WRITE > > request, or an out-of-bounds kernel read with an SMB READ request, by > > supplying multiple RDMA buffer descriptors with an oversized descriptor > > before the last one. > > > > Remove the premature assignment to buf_len. Subtracting the clamped length > > already consumes the remaining buffer, so the next iteration stops and > > only descriptors within the local buffer are used to build work requests. > > > > Fixes: e628bf939aaf ("ksmbd: reduce descriptor size if remaining bytes is less than request size") > > Cc: stable@vger.kernel.org > > Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-33549 > > Signed-off-by: Stefan Metzmacher > > Signed-off-by: Namjae Jeon > > > > diff --git a/fs/smb/smbdirect/rw.c b/fs/smb/smbdirect/rw.c > > index 6fe38042cfb9..cb142c3c50b2 100644 > > --- a/fs/smb/smbdirect/rw.c > > +++ b/fs/smb/smbdirect/rw.c > > @@ -143,7 +143,6 @@ int smbdirect_connection_rdma_xmit(struct smbdirect_socket *sc, > > if (desc_buf_len > buf_len) { > > desc_buf_len = buf_len; > > desc[i].length = cpu_to_le32(desc_buf_len); > > - buf_len = 0; > > } > > credits_needed += smbdirect_connection_calc_rw_credits(sc, > > In older releases this is smb_direct_rdma_xmit() in fs/smb/server/transport_rdma.c > > I hope that helps. A backported patch would help best :)