Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.0/patches/2220129/?format=api
{ "id": 2220129, "url": "http://patchwork.ozlabs.org/api/1.0/patches/2220129/?format=api", "project": { "id": 12, "url": "http://patchwork.ozlabs.org/api/1.0/projects/12/?format=api", "name": "Linux CIFS Client", "link_name": "linux-cifs-client", "list_id": "linux-cifs.vger.kernel.org", "list_email": "linux-cifs@vger.kernel.org", "web_url": "", "scm_url": "", "webscm_url": "" }, "msgid": "<2026040646-backlit-overlord-2d46@gregkh>", "date": "2026-04-06T13:46:46", "name": "[1/3] ksmbd: validate EaNameLength in smb2_get_ea()", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "d6cc01ba627606fbcf2902cda7611639954e08b5", "submitter": { "id": 11800, "url": "http://patchwork.ozlabs.org/api/1.0/people/11800/?format=api", "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linux-cifs-client/patch/2026040646-backlit-overlord-2d46@gregkh/mbox/", "series": [ { "id": 498855, "url": "http://patchwork.ozlabs.org/api/1.0/series/498855/?format=api", "date": "2026-04-06T13:46:46", "name": "ksmbd: some potential bugfixes", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/498855/mbox/" } ], "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2220129/checks/", "tags": {}, "headers": { "Return-Path": "\n <linux-cifs+bounces-10675-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linux-cifs@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org\n header.a=rsa-sha256 header.s=korg header.b=aRFdxqj1;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=linux-cifs+bounces-10675-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=linuxfoundation.org\n header.i=@linuxfoundation.org header.b=\"aRFdxqj1\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=10.30.226.201" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fq9c56dxLz1xy1\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 06 Apr 2026 23:47:01 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 67F853006B42\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 6 Apr 2026 13:46:59 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 78D36175A9E;\n\tMon, 6 Apr 2026 13:46:58 +0000 (UTC)", "from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org\n [10.30.226.201])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 44F8035893;\n\tMon, 6 Apr 2026 13:46:57 +0000 (UTC)", "by smtp.kernel.org (Postfix) with ESMTPSA id 5F090C4CEF7;\n\tMon, 6 Apr 2026 13:46:57 +0000 (UTC)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1775483218; cv=none;\n b=Psnaj/DXoVg5lT6j0EYPWKmw3z0iworPo9FREepkSo3suFWcup4sLzv4sOeTAE5w2Va9m+4Ypjcqmm1+C67e+z7E+MmtavcQBIKsM+UcfcYPtdaqO3eVc5BHVHRgJjAcQLv/nxBQA0sSv+iJYVJ0uFpJZ5cemH3RoSBj6uaxjyQ=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1775483218; c=relaxed/simple;\n\tbh=3aTYSApV0Q+/AB73UF0VuMJRhyBvMMPWQbyZsbikUzE=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=QPpMDT/14L/vYNbYVqcVHngJClKZOCgd+CLm8AYLiLCBiGbfDsDmfSkMzZVhwUjelqbNC2AvNmkurXjF6o8Vn2qv/byz3uTb20LBvRtR1YvJbjTVZVQlhl+8JJeVwTpf1GXUztdpBI/efg8SHzke4k3oEJWquRsgfH4l7Sg6SD4=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dkim=pass (1024-bit key) header.d=linuxfoundation.org\n header.i=@linuxfoundation.org header.b=aRFdxqj1;\n arc=none smtp.client-ip=10.30.226.201", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;\n\ts=korg; t=1775483217;\n\tbh=3aTYSApV0Q+/AB73UF0VuMJRhyBvMMPWQbyZsbikUzE=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=aRFdxqj1jsl4oMpIbGzwJXEa82SyXNtzPHLXhQ5ms9bE72fW66xJBYXcuHVqEUPN+\n\t H7Rz0Oe9n7tBigLBWUNykYHVN1V3NkflHPGP5ofSEsBWNV8NLFMYDH7EzVMe9NBCBB\n\t ugYjeaFcKS4MB9ovtvAOjlhLRuOl/dlO8keCptuA=", "From": "Greg Kroah-Hartman <gregkh@linuxfoundation.org>", "To": "linux-cifs@vger.kernel.org", "Cc": "linux-kernel@vger.kernel.org,\n\tGreg Kroah-Hartman <gregkh@linuxfoundation.org>,\n\tNamjae Jeon <linkinjeon@kernel.org>,\n\tSteve French <smfrench@gmail.com>,\n\tSergey Senozhatsky <senozhatsky@chromium.org>,\n\tTom Talpey <tom@talpey.com>,\n\tstable <stable@kernel.org>", "Subject": "[PATCH 1/3] ksmbd: validate EaNameLength in smb2_get_ea()", "Date": "Mon, 6 Apr 2026 15:46:46 +0200", "Message-ID": "<2026040646-backlit-overlord-2d46@gregkh>", "X-Mailer": "git-send-email 2.53.0", "In-Reply-To": "<2026040644-brussels-dab-6f99@gregkh>", "References": "<2026040644-brussels-dab-6f99@gregkh>", "Precedence": "bulk", "X-Mailing-List": "linux-cifs@vger.kernel.org", "List-Id": "<linux-cifs.vger.kernel.org>", "List-Subscribe": "<mailto:linux-cifs+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:linux-cifs+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Lines": "41", "X-Developer-Signature": "v=1; a=openpgp-sha256; l=1594;\n i=gregkh@linuxfoundation.org; h=from:subject:message-id;\n bh=3aTYSApV0Q+/AB73UF0VuMJRhyBvMMPWQbyZsbikUzE=;\n b=owGbwMvMwCRo6H6F97bub03G02pJDJmXd7odeK/KvMc7v+LY2r/NG3mu/U/xqtC9pVnwe+fMX\n ma5rvspHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCR7j6GeTrf1oo8s76+37ns\n W7SFx1pX1qnGcxgWzNiblFL4eJVpjDxrbVaBjOS549GbAA==", "X-Developer-Key": "i=gregkh@linuxfoundation.org; a=openpgp;\n fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29", "Content-Transfer-Encoding": "8bit" }, "content": "smb2_get_ea() reads ea_req->EaNameLength from the client request and\npasses it directly to strncmp() as the comparison length without\nverifying that the length of the name really is the size of the input\nbuffer recieved.\n\nFix this up by properly checking the size of the name based on the value\nrecieved and the overall size of the request, to prevent a later\nstrncmp() call to use the length as a \"trusted\" size of the buffer.\nWithout this check, uninitialized heap values might be slowly leaked to\nthe client.\n\nCc: Namjae Jeon <linkinjeon@kernel.org>\nCc: Steve French <smfrench@gmail.com>\nCc: Sergey Senozhatsky <senozhatsky@chromium.org>\nCc: Tom Talpey <tom@talpey.com>\nCc: linux-cifs@vger.kernel.org\nCc: stable <stable@kernel.org>\nAssisted-by: gregkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n---\n fs/smb/server/smb2pdu.c | 5 +++++\n 1 file changed, 5 insertions(+)", "diff": "diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c\nindex 8e4cfdc0ba02..6f658dc20758 100644\n--- a/fs/smb/server/smb2pdu.c\n+++ b/fs/smb/server/smb2pdu.c\n@@ -4716,6 +4716,11 @@ static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp,\n \n \t\tea_req = (struct smb2_ea_info_req *)((char *)req +\n \t\t\t\t\t\t le16_to_cpu(req->InputBufferOffset));\n+\n+\t\tif (le32_to_cpu(req->InputBufferLength) <\n+\t\t offsetof(struct smb2_ea_info_req, name) +\n+\t\t ea_req->EaNameLength)\n+\t\t\treturn -EINVAL;\n \t} else {\n \t\t/* need to send all EAs, if no specific EA is requested*/\n \t\tif (le32_to_cpu(req->Flags) & SL_RETURN_SINGLE_ENTRY)\n", "prefixes": [ "1/3" ] }