Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.0/patches/2223084/?format=api
{ "id": 2223084, "url": "http://patchwork.ozlabs.org/api/1.0/patches/2223084/?format=api", "project": { "id": 12, "url": "http://patchwork.ozlabs.org/api/1.0/projects/12/?format=api", "name": "Linux CIFS Client", "link_name": "linux-cifs-client", "list_id": "linux-cifs.vger.kernel.org", "list_email": "linux-cifs@vger.kernel.org", "web_url": "", "scm_url": "", "webscm_url": "" }, "msgid": "<20260414115040.552945-1-werner@verivus.com>", "date": "2026-04-14T11:50:42", "name": "smb: client: fix OOB read in symlink error response parsing", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "4f9c525c0dfe4388c2755fe767cc1c97ef9f5e08", "submitter": { "id": 92883, "url": "http://patchwork.ozlabs.org/api/1.0/people/92883/?format=api", "name": "Werner Kasselman", "email": "werner@verivus.ai" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linux-cifs-client/patch/20260414115040.552945-1-werner@verivus.com/mbox/", "series": [ { "id": 499825, "url": "http://patchwork.ozlabs.org/api/1.0/series/499825/?format=api", "date": "2026-04-14T11:50:42", "name": "smb: client: fix OOB read in symlink error response parsing", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/499825/mbox/" } ], "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2223084/checks/", "tags": {}, "headers": { "Return-Path": "\n <linux-cifs+bounces-10802-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linux-cifs@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=verivus.ai header.i=@verivus.ai header.a=rsa-sha256\n header.s=selector1 header.b=BxOY93Tg;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=linux-cifs+bounces-10802-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key)\n header.d=verivus.ai header.i=@verivus.ai header.b=\"BxOY93Tg\"", "smtp.subspace.kernel.org;\n arc=fail smtp.client-ip=40.107.40.97", "smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=verivus.ai", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=verivus.ai", "dkim=none (message not signed)\n header.d=none;dmarc=none action=none header.from=verivus.ai;" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fw2gB4pMVz1y2d\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 14 Apr 2026 21:51:34 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 20C55302D5CE\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 14 Apr 2026 11:50:51 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 723883DA7FD;\n\tTue, 14 Apr 2026 11:50:50 +0000 (UTC)", "from SY5PR01CU010.outbound.protection.outlook.com\n (mail-australiaeastazon11022097.outbound.protection.outlook.com\n [40.107.40.97])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 89EA83D5640;\n\tTue, 14 Apr 2026 11:50:48 +0000 (UTC)", "from ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM (2603:10c6:220:22a::5)\n by SY2PPF495465E43.AUSP300.PROD.OUTLOOK.COM (2603:10c6:18::397) with\n Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.48; Tue, 14 Apr\n 2026 11:50:43 +0000", "from ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM\n ([fe80::1e3f:9cb9:4a95:b5a2]) by ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM\n ([fe80::1e3f:9cb9:4a95:b5a2%5]) with mapi id 15.20.9818.017; Tue, 14 Apr 2026\n 11:50:42 +0000" ], "ARC-Seal": [ "i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776167450; cv=fail;\n b=f929LNK/N+L2zZn00dOuidhj9cB//5WbopSV4EQfUqf8+3v+8pxI+D5d3fopnH44HgrlLwGgTSrh4QWXbhxsxagCSTi0XjA/Durl399aJ9/4Ob1tzD7bAHTaF222AjnaGFhZiE9D7OPtL46aoWzL1SXWdJXtZusyeR0vCoLSdAI=", "i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;\n b=dCH1EJoOwfIcTxLGbwZ+ymF1p7U7te/d5vghovDFvJpeQIJSAwHWu9manJ9OxHB0FKn91ogYX1MFymJWk3pFC79Hv0Z/1zgKQEeWBxGb9WzFdY/TWlPh6TxAg5VDraZog4vxoiSccpMVuPK3VRPjloNXfPcnqRvp9ynlbGTB2OkSxIPINOUdrOmE0+tNfqm4Abk60FoC7RIdXbFDmx+g3bdvWy735jOo/LiK7Uu+vBlO/MfQ6xI36nBpriZ0bcC9tzZeK6FkRHCkYDNBNqqvnMVWheDHJapoGfjYuifK4LotFGFUjhEOOmQAMfcXyIWJ4fP6TaeCssW6c0Ps+jUjHQ==" ], "ARC-Message-Signature": [ "i=2; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776167450; c=relaxed/simple;\n\tbh=FnktY08WLfdJpqcpBfJW9P7G/X9/aFH7An5y+1EIrNI=;\n\th=From:To:CC:Subject:Date:Message-ID:Content-Type:MIME-Version;\n b=CC4fsYwMM7exnWHTAy0i67C+2456hSeFHVLT8c1b5D/aHBpvizTaHjA6pNv0L5kzw9k3pvdN6i1zPN3EY1Lq1wZGKXWb9VpbNBol9aMbGyKqzDTRj7dilU0tKKHOgwx/45XC8zYMAbg/fq+SBHap3HniMbtGo7l5zg9h+wcES7M=", "i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;\n s=arcselector10001;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;\n bh=Whuk5+gObE0bX9e1/WH4sL4w0oz9E2Ng4M10DL9N2w8=;\n b=g01yP5GakI5VY5aO6V6bh4SwcnZ8vbGMkDpx3jhAyK4RFJIDgc3w+jweQx0HQ9TDJ21aNBk7L2ZzDlOmT7+5mnYxayeGhEyGWDIdObGieiCuz+o1L+J4XVr+r3mQX8drAOHMBy5LtbdMIIkXmeRHG3daf12GJK+SXIG4FKZ/naRBrzG8BWz+WNPJgStXk4Sim5Th3ruUhrSUwHJLBejHZA1kYsxOYp22jXRvm2xPx9U82LGxjkF2fgp0YiaIGdgtZUBea6ZuauHletWeXBH9uvdKrJcuvAY9RBllWOpjqYMFdCEKw4lDpJ3lAUNSHGTW/nV++8I4tkI/jPsio/dKwQ==" ], "ARC-Authentication-Results": [ "i=2; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=verivus.ai;\n spf=pass smtp.mailfrom=verivus.ai;\n dkim=fail (2048-bit key) header.d=verivus.ai header.i=@verivus.ai\n header.b=BxOY93Tg reason=\"signature verification failed\";\n arc=fail smtp.client-ip=40.107.40.97", "i=1; mx.microsoft.com 1; spf=pass\n smtp.mailfrom=verivus.ai; dmarc=pass action=none header.from=verivus.ai;\n dkim=pass header.d=verivus.ai; arc=none" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=verivus.ai;\n s=selector1;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;\n bh=Whuk5+gObE0bX9e1/WH4sL4w0oz9E2Ng4M10DL9N2w8=;\n b=BxOY93Tga5j82DyXLqY5MARvLHJupVxkNWK+mwVtAl4x2PLZM/ZhxzNDT8kwemOoyd8SNA2E5Go9Pr1bb0sM+eLGV3z+43t/KghW6YzB0qj+xAtRAB6Ym1UMhNi/mBrAPpRBzg10cAll91BXyX/o+uvUT9PlwP5bO60TsRiZ9e2gmIKSlLouJulcfUG1HHLJD8Lx/TgIrycRJbpmNaMaG1vxhZjrVWBhXNb8KNiB0uJHuBV6fqNm/5MLVBplrQUHFBZyUR0h4zRNHOs0UiZqiKynK+tirNYu5wRBCG5kXLtQ3D5P7DL0sCiizDTsFIB1k8Cx0rt8bYt5ajfA40a26Q==", "From": "Werner Kasselman <werner@verivus.ai>", "To": "\"linux-cifs@vger.kernel.org\" <linux-cifs@vger.kernel.org>", "CC": "\"sfrench@samba.org\" <sfrench@samba.org>, \"pc@manguebit.org\"\n\t<pc@manguebit.org>, \"ronniesahlberg@gmail.com\" <ronniesahlberg@gmail.com>,\n\t\"sprasad@microsoft.com\" <sprasad@microsoft.com>, \"tom@talpey.com\"\n\t<tom@talpey.com>, \"bharathsm@microsoft.com\" <bharathsm@microsoft.com>,\n\t\"samba-technical@lists.samba.org\" <samba-technical@lists.samba.org>,\n\t\"linux-kernel@vger.kernel.org\" <linux-kernel@vger.kernel.org>, Werner\n Kasselman <werner@verivus.ai>, \"stable@vger.kernel.org\"\n\t<stable@vger.kernel.org>", "Subject": "[PATCH] smb: client: fix OOB read in symlink error response parsing", "Thread-Topic": "[PATCH] smb: client: fix OOB read in symlink error response\n parsing", "Thread-Index": "AQHczATrjU+iZC/b2kiYDmi/0MRytg==", "Date": "Tue, 14 Apr 2026 11:50:42 +0000", "Message-ID": "<20260414115040.552945-1-werner@verivus.com>", "Accept-Language": "en-AU, en-AT, en-GB, en-US", "Content-Language": "en-US", "X-MS-Has-Attach": "", "X-MS-TNEF-Correlator": "", "x-mailer": "git-send-email 2.43.0", "authentication-results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=verivus.ai header.i=@verivus.ai header.a=rsa-sha256\n header.s=selector1 header.b=BxOY93Tg;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=linux-cifs+bounces-10802-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key)\n header.d=verivus.ai header.i=@verivus.ai header.b=\"BxOY93Tg\"", "smtp.subspace.kernel.org;\n arc=fail smtp.client-ip=40.107.40.97", "smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=verivus.ai", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=verivus.ai", "dkim=none (message not signed)\n header.d=none;dmarc=none action=none header.from=verivus.ai;" ], "x-ms-publictraffictype": "Email", "x-ms-traffictypediagnostic": "ME0P300MB0853:EE_|SY2PPF495465E43:EE_", "x-ms-office365-filtering-correlation-id": "79f1b76c-cc27-43ae-fed7-08de9a1c0e50", "x-ms-exchange-senderadcheck": "1", "x-ms-exchange-antispam-relay": "0", "x-microsoft-antispam": "\n BCL:0;ARA:13230040|366016|1800799024|376014|7416014|38070700021|56012099003|18002099003;", "x-microsoft-antispam-message-info": "\n mnR8RqILLZh/6peOoeRsn6WODVYT3ar7Jmtj1chHGzC5J79j2OXSR1HwASWxFOn4o5V3PCRmMFOZhsBDPbQIWe9a3ieOn8z746upI3t4266vu99i9GtDK0jm2bFal8+VjctGxKOufXMPmyV3fFXOtJtKJTbtUOGmh4VBjhJjbqozomo2O393cHlQKaUV+dCwiDfU190P4y3khEgD0WqPAmxMpIrpgFN9Xs6utEoCoEVpMI4MmOd9w31W0o9zzju+JBduKvptMg2+W3aOZ6mmWTHr5Cf8hd3vL/s4JRmEZHmNAH0Wn+SGhDin/NZ6cVPFPT3khfYB53SLM9GA6FUEBzsJu8OAkgFblaNb3/LTD/RpWmBPBquqIzCak5mu4+NT5Gua/d3xW1hIPg5d9PfgZcWUs4PaG/zZxD5guhaaZAmgkCBIVERTt37HUgfjy8FRzTxb0kD87Ilc26s2mAsfTs6sQ4BmoZkG02dvHaZTvUNKAjtglBuh60XzFP0nJGUh5ELyrT5bDDDEK2ssU/5WIpz8yqp7nMz1SwT7GhkBb/2y0avqBTmVTA6Xcwtjl1QFC18dq4qrWA1b/lP0CmqwtnWIwzD0hrTxevI3cL7waa+GgxMC7NLbRloVvwWCodAxkpeJofOi3uv6ppVVuJoOJ4a8xAgqQRtdLtYppKxsEFnxw4jT14o10BxxNIz4mgqA/a3jFEDXsvnmAB6OWI0AYPkCtQrpw7jowa3Z70V62Sbfnx/Yr0LO+gwfRMKFD0eQ6QrSq/9xy8DqUr5hvniQzh+ri1SWivmQhBaoP2PmP/I=", "x-forefront-antispam-report": "\n CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(376014)(7416014)(38070700021)(56012099003)(18002099003);DIR:OUT;SFP:1102;", "x-ms-exchange-antispam-messagedata-chunkcount": "1", "x-ms-exchange-antispam-messagedata-0": "=?iso-8859-1?q?MB4xuIYfFkLG64anHb7VBTS?=\n\t=?iso-8859-1?q?KZjri6FrUhwpUCraIFn3bHZJ4hDfSLzzJNekj40M5qUygFbrk39lCjJG1s5K?=\n\t=?iso-8859-1?q?6EQnimhQmutlqNjfNoeEBbEVkueuHs58eoPeRc4yMZGfaLoVc1QEQsxrxKZM?=\n\t=?iso-8859-1?q?PcWM0CDWutqLA8MxCn1z6US+7IsoJ4vRvfzEM1pTRwATW3N2UXlFITjMnkwM?=\n\t=?iso-8859-1?q?YXNcbPLFBlt310iBcD3RuL8QRKgFA7V3a+g+baOSCg/HxQ8/I0NmZtvdaAfq?=\n\t=?iso-8859-1?q?vtXSI61Gpan85wjiEiYiBAZ0G8Z7bGtpaTaw3RxCOpChncFfb0MBNYA7B58i?=\n\t=?iso-8859-1?q?WibZyqz0hfd82PgDY65r2oNNMvZxfPOoNrvHPRSfK2MPUPYUdo66eqmTCwoX?=\n\t=?iso-8859-1?q?4VaOKvMYW7dpj+pTn0FRONdSxoxTgx13XBjinO8pH3IxNjgWseNB6bT720aX?=\n\t=?iso-8859-1?q?VV+lc6MgpD59sbV/bz6BYi2nfm548xlEMrM6gAdtsoM4QFSOjgh9BYRhgPhj?=\n\t=?iso-8859-1?q?+KRmMwz3uwZzLQWFEipi0n+c0tSzwiSma4CD/oy2SMoAbYIv2MotdloYpWQN?=\n\t=?iso-8859-1?q?xU+EZXzS5cqZ1T6VAU79Rt6uLy7iVoLoWt15hKd6cvyHaEu0E9E3I/CxcEvs?=\n\t=?iso-8859-1?q?A9E25r7tusx79TPHEAiWlqMIsuZ/CKSPT5QjZ+dYYuZw0hkN6lAZVS2fUeBO?=\n\t=?iso-8859-1?q?+KLT4u2gQlGF3yWbFW8YvzsM3pJZK7nDghw8vG7HwzIYTUXub7hTYrmg8uzO?=\n\t=?iso-8859-1?q?BXI7wJY1sYqdV+bS30BZ3lcx9GYSwe0PBE57heM3+bo8D+CeCrpm7jNWreTe?=\n\t=?iso-8859-1?q?08dwxe/cEZNLYlfshhNz76i0xFtTtctlCvBEkkyrO8o1oFbs0Nkle0tICDhh?=\n\t=?iso-8859-1?q?35TuyJiE1Ojuq1t/6PPJe94jRs4tt22rnUGAL8zinXLZ1c1/NsXgGWm87z3Q?=\n\t=?iso-8859-1?q?tqinTDL5sKnm8S189EtAHhFK+PHt53rQafw62kcJg7rS8kqhgPZqiz+9MkTF?=\n\t=?iso-8859-1?q?v7iUI1OyIdki+5PAjFQFdrxHkNVdBsDlFE1xKeWwqREL8t4N9PcDHOR79w04?=\n\t=?iso-8859-1?q?T9x7+2eMN+Oggx5KpS9yRPtYA+DrNqG+ufiG5ijFzP7QAfoAqneVpp3fSNgK?=\n\t=?iso-8859-1?q?qxSeSwK9ZZFuFwxdcYoT+PM4vIlN5YeQHNz2hP8WoAl2Otji8Drr5mn8td+f?=\n\t=?iso-8859-1?q?g5HOaqSC1DLK35Z4yklthLg7oLHsRE5qji1kpE+lTMWJo32F6t+KVU/nUrUm?=\n\t=?iso-8859-1?q?n8QPL8Z0Va+xY2q1k8+DWUQEJxmQsHIVXNpWkA5R5gCJuc//9Xr6ijRf5xZJ?=\n\t=?iso-8859-1?q?WYY8V1PjVGbdHupgogIc3oRRUFRzl+F0lBtNDPpewPh7o/jfceL/RpbCBcap?=\n\t=?iso-8859-1?q?2klKbIZh6g3NOp0UrRXlFh4cPSGE2WfEeDVJz4mvnWvdHcHz4n5H65UfXSV1?=\n\t=?iso-8859-1?q?x1SrwixfihzyJuCyAhFx7pYK3K/p3UruhIk/5jvaJg0477OG9B1EzL6uKGvb?=\n\t=?iso-8859-1?q?gBM1NKJxYwRF/Oyx34q8YrQRPuSUsBy/k3QlXBRbzh9MH+V1vygyVie6LLBM?=\n\t=?iso-8859-1?q?5KV1eCmVBJzULQ/HIBwSXj3pu111ogvPcVnDbdQCWa8INEC3jJlwOjtk90+O?=\n\t=?iso-8859-1?q?e0Gvauxj+LLWk5gfAxh8ebAHCAWiOuVhHTTCF2P0oZHOvVxKcvaUtIV/xVnO?=\n\t=?iso-8859-1?q?ag2cboKitnXfPQM+vQVTVCSvS6cakE1XT4xyvYytIyfJVwGSBZSS6wj7sOR1?=\n\t=?iso-8859-1?q?ctMLhZZrKs8toBYT2nXEsMgQIgVi/z0UUSzEUud86cSR6IA=3D=3D?=", "Content-Type": "text/plain; charset=\"iso-8859-1\"", "Content-Transfer-Encoding": "quoted-printable", "Precedence": "bulk", "X-Mailing-List": "linux-cifs@vger.kernel.org", "List-Id": "<linux-cifs.vger.kernel.org>", "List-Subscribe": "<mailto:linux-cifs+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:linux-cifs+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "X-OriginatorOrg": "verivus.ai", "X-MS-Exchange-CrossTenant-AuthAs": "Internal", "X-MS-Exchange-CrossTenant-AuthSource": "ME0P300MB0853.AUSP300.PROD.OUTLOOK.COM", "X-MS-Exchange-CrossTenant-Network-Message-Id": "\n 79f1b76c-cc27-43ae-fed7-08de9a1c0e50", "X-MS-Exchange-CrossTenant-originalarrivaltime": "14 Apr 2026 11:50:42.2679\n (UTC)", "X-MS-Exchange-CrossTenant-fromentityheader": "Hosted", "X-MS-Exchange-CrossTenant-id": "ccdcedb0-4edc-4cc8-9791-c44ee6610030", "X-MS-Exchange-CrossTenant-mailboxtype": "HOSTED", "X-MS-Exchange-CrossTenant-userprincipalname": "\n H2CyRyOpY99/YuQNcBDaYFqUont95g++4FWnB3U3edT+YdFVpNmJYzP7RR+JGzQzJDthL/y52cwt9TSkGRuBWQ==", "X-MS-Exchange-Transport-CrossTenantHeadersStamped": "SY2PPF495465E43" }, "content": "symlink_data() walks server-supplied SMB2 error contexts to locate the\nsmb2_symlink_err_rsp before returning it to smb2_parse_symlink_response().\nWhen ErrorContextCount is non-zero, sym can land at an attacker-chosen\noffset past the smb2_err_rsp header, bounded only by iov_len.\n\nReads of p->ErrorId and p->ErrorDataLength in the walk loop occur\nwithout checking that the smb2_error_context_rsp header fits in the\nresponse buffer, and sym is dereferenced for SymLinkErrorTag/ReparseTag\nwithout checking that sym itself fits. A context header placed near\niov_end produces an OOB read.\n\nThe bounds check in smb2_parse_symlink_response() uses the compile-time\nSMB2_SYMLINK_STRUCT_SIZE as the base for SubstituteName and PrintName\nranges. That only matches the fixed layout when ErrorContextCount is\nzero; with contexts, the actual PathBuffer offset in iov is larger, and\nthe read of sym->PathBuffer + sub_offs for sub_len bytes can extend\npast iov_len into adjacent slab memory. The copied bytes reach\nuserspace via readlink() on data->symlink_target.\n\nSTATUS_STOPPED_ON_SYMLINK responses are served from the 448-byte small\nbuffer pool, so the overread reliably crosses the slab object boundary.\n\nBound each context header during the walk, verify sym fits in the\nresponse before dereferencing its length fields, and compute the\nPathBuffer bound from sym->PathBuffer's actual offset into iov.\n\nFixes: 76894f3e2f71 (\"cifs: improve symlink handling for smb2+\")\nCc: stable@vger.kernel.org\nSigned-off-by: Werner Kasselman <werner@verivus.com>\n---\n fs/smb/client/smb2file.c | 22 +++++++++++++++++-----\n 1 file changed, 17 insertions(+), 5 deletions(-)", "diff": "diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c\nindex ed651c946251..6fda8ec7fe9b 100644\n--- a/fs/smb/client/smb2file.c\n+++ b/fs/smb/client/smb2file.c\n@@ -41,6 +41,8 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)\n \t\tp = (struct smb2_error_context_rsp *)err->ErrorData;\n \t\tend = (struct smb2_error_context_rsp *)((u8 *)err + iov->iov_len);\n \t\tdo {\n+\t\t\tif ((u8 *)p + sizeof(*p) > (u8 *)end)\n+\t\t\t\treturn ERR_PTR(-EINVAL);\n \t\t\tif (le32_to_cpu(p->ErrorId) == SMB2_ERROR_ID_DEFAULT) {\n \t\t\t\tsym = (struct smb2_symlink_err_rsp *)p->ErrorContextData;\n \t\t\t\tbreak;\n@@ -56,9 +58,15 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov)\n \t\tsym = (struct smb2_symlink_err_rsp *)err->ErrorData;\n \t}\n \n-\tif (!IS_ERR(sym) && (le32_to_cpu(sym->SymLinkErrorTag) != SYMLINK_ERROR_TAG ||\n-\t\t\t le32_to_cpu(sym->ReparseTag) != IO_REPARSE_TAG_SYMLINK))\n-\t\tsym = ERR_PTR(-EINVAL);\n+\tif (IS_ERR(sym))\n+\t\treturn sym;\n+\n+\tif ((u8 *)sym + sizeof(*sym) > (u8 *)err + iov->iov_len)\n+\t\treturn ERR_PTR(-EINVAL);\n+\n+\tif (le32_to_cpu(sym->SymLinkErrorTag) != SYMLINK_ERROR_TAG ||\n+\t le32_to_cpu(sym->ReparseTag) != IO_REPARSE_TAG_SYMLINK)\n+\t\treturn ERR_PTR(-EINVAL);\n \n \treturn sym;\n }\n@@ -115,6 +123,7 @@ int smb2_parse_symlink_response(struct cifs_sb_info *cifs_sb, const struct kvec\n \tstruct smb2_symlink_err_rsp *sym;\n \tunsigned int sub_offs, sub_len;\n \tunsigned int print_offs, print_len;\n+\tsize_t pathbuf_off;\n \n \tif (!cifs_sb || !iov || !iov->iov_base || !iov->iov_len || !path)\n \t\treturn -EINVAL;\n@@ -128,8 +137,11 @@ int smb2_parse_symlink_response(struct cifs_sb_info *cifs_sb, const struct kvec\n \tprint_len = le16_to_cpu(sym->PrintNameLength);\n \tprint_offs = le16_to_cpu(sym->PrintNameOffset);\n \n-\tif (iov->iov_len < SMB2_SYMLINK_STRUCT_SIZE + sub_offs + sub_len ||\n-\t iov->iov_len < SMB2_SYMLINK_STRUCT_SIZE + print_offs + print_len)\n+\tpathbuf_off = (const u8 *)sym->PathBuffer - (const u8 *)iov->iov_base;\n+\n+\tif (pathbuf_off > iov->iov_len ||\n+\t iov->iov_len - pathbuf_off < sub_offs + sub_len ||\n+\t iov->iov_len - pathbuf_off < print_offs + print_len)\n \t\treturn -EINVAL;\n \n \treturn smb2_parse_native_symlink(path,\n", "prefixes": [] }