Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2233292/?format=api
{ "id": 2233292, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2233292/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-cifs-client/patch/20260506034908.3874700-2-zisenye@stu.xidian.edu.cn/", "project": { "id": 12, "url": "http://patchwork.ozlabs.org/api/1.2/projects/12/?format=api", "name": "Linux CIFS Client", "link_name": "linux-cifs-client", "list_id": "linux-cifs.vger.kernel.org", "list_email": "linux-cifs@vger.kernel.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260506034908.3874700-2-zisenye@stu.xidian.edu.cn>", "list_archive_url": null, "date": "2026-05-06T03:49:08", "name": "[v4,1/1] smb/client: fix out-of-bounds read in smb2_compound_op()", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "5da6263c7072f3b907d85c47a123809b3c2753b0", "submitter": { "id": 93303, "url": "http://patchwork.ozlabs.org/api/1.2/people/93303/?format=api", "name": "Zisen Ye", "email": "zisenye@stu.xidian.edu.cn" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linux-cifs-client/patch/20260506034908.3874700-2-zisenye@stu.xidian.edu.cn/mbox/", "series": [ { "id": 502924, "url": "http://patchwork.ozlabs.org/api/1.2/series/502924/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-cifs-client/list/?series=502924", "date": "2026-05-06T03:49:07", "name": "smb/client: fix out-of-bounds read", "version": 4, "mbox": "http://patchwork.ozlabs.org/series/502924/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2233292/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2233292/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <linux-cifs+bounces-11384-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linux-cifs@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"key not found in DNS\" header.d=stu.xidian.edu.cn\n header.i=@stu.xidian.edu.cn header.a=rsa-sha256 header.s=dkim\n header.b=7LXt8rZU;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.105.105.114; helo=tor.lore.kernel.org;\n envelope-from=linux-cifs+bounces-11384-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=fail reason=\"key not found in DNS\" (0-bit key)\n header.d=stu.xidian.edu.cn header.i=@stu.xidian.edu.cn header.b=\"7LXt8rZU\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=162.243.164.118", "smtp.subspace.kernel.org;\n dmarc=pass (p=quarantine dis=none) header.from=stu.xidian.edu.cn", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=stu.xidian.edu.cn" ], "Received": [ "from tor.lore.kernel.org (tor.lore.kernel.org [172.105.105.114])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g9LxL2pY1z1yJq\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 06 May 2026 13:49:58 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id 730E1304292F\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 6 May 2026 03:49:56 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 90DE52D837C;\n\tWed, 6 May 2026 03:49:55 +0000 (UTC)", "from zg8tmtyylji0my4xnjqumte4.icoremail.net\n (zg8tmtyylji0my4xnjqumte4.icoremail.net [162.243.164.118])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id D949E2D1913;\n\tWed, 6 May 2026 03:49:50 +0000 (UTC)", "from Jason.localdomain (unknown [113.200.174.116])\n\tby hzbj-edu-front-4.icoremail.net (Coremail) with SMTP id\n BrQMCkDGZ7M0uvpp01juAQ--.23165S3;\n\tWed, 06 May 2026 11:49:20 +0800 (CST)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1778039395; cv=none;\n b=X7nSjLwQt9ku3MisDmUfnp0ogXFY58ICZhjmXlzYhKRRAT0LesjzyEyWGvrG9w10iFgGYWcFNeOhEnD9qjyc+GqP1no4Phxh+IZVzHEYsaWnykR3EUEV6b3ZknNrEmIn7QC2obC9X/XgZgqXLzhoryhn1cjkBSMfPyC3gpgMaiQ=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1778039395; c=relaxed/simple;\n\tbh=dR9S21Ef+B8wZ2oRwFED15hARPcdTt7yuugtPcBtXPE=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=Jtrb+K27FbWf93NbWcwzWKDRHNK3N73D/Ys66aJNWpbdgc2QfG4PCxy8UEMMUG+7is2GfoHYluQGmxCpSWGYEVeAiflzmq6PrzLRw/ToIcXMRdmb7EnrfGR7k4W0tLjOtY8YGkXRV9EMh2NyD69ne9XI5ZxlC0N/71U33kDviAs=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=quarantine dis=none) header.from=stu.xidian.edu.cn;\n spf=pass smtp.mailfrom=stu.xidian.edu.cn;\n dkim=fail (0-bit key) header.d=stu.xidian.edu.cn header.i=@stu.xidian.edu.cn\n header.b=7LXt8rZU reason=\"key not found in DNS\";\n arc=none smtp.client-ip=162.243.164.118", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=stu.xidian.edu.cn; s=dkim; h=Received:From:To:Cc:Subject:Date:\n\tMessage-ID:In-Reply-To:References:MIME-Version:\n\tContent-Transfer-Encoding; bh=EGV2iv00kwmxS1ma8u2C3h/lV7X7cQpIEx\n\ttILqI6N9A=; b=7LXt8rZUhW02uPT2gbOQFF4ZRdbV5ZP6eiZ8Hz9PbsM5Th0Ah6\n\tjUW8dR1W1xb2Uv6Lbz2YdLTEcv2fmhErNKVrCRkOicYinRu1hqmBxSTMQs9c0Q5F\n\tBBk4B5EwYc119Ltjpscyfab+VgYuRkptqi+SbutJTfid3vr6J9unnMAw0=", "From": "zisenye@stu.xidian.edu.cn", "To": "smfrench@gmail.com,\n\tlinkinjeon@kernel.org,\n\tpc@manguebit.org,\n\tronniesahlberg@gmail.com,\n\tsprasad@microsoft.com,\n\ttom@talpey.com,\n\tbharathsm@microsoft.com,\n\tsenozhatsky@chromium.org,\n\tdhowells@redhat.com,\n\tgregkh@linuxfoundation.org,\n\tchenxiaosong@chenxiaosong.com,\n\tstable@vger.kernel.org", "Cc": "linux-cifs@vger.kernel.org", "Subject": "[PATCH v4 1/1] smb/client: fix out-of-bounds read in\n smb2_compound_op()", "Date": "Wed, 6 May 2026 11:49:08 +0800", "Message-ID": "<20260506034908.3874700-2-zisenye@stu.xidian.edu.cn>", "X-Mailer": "git-send-email 2.43.0", "In-Reply-To": "<20260506034908.3874700-1-zisenye@stu.xidian.edu.cn>", "References": "<20260506034908.3874700-1-zisenye@stu.xidian.edu.cn>", "Precedence": "bulk", "X-Mailing-List": "linux-cifs@vger.kernel.org", "List-Id": "<linux-cifs.vger.kernel.org>", "List-Subscribe": "<mailto:linux-cifs+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:linux-cifs+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-CM-TRANSID": "BrQMCkDGZ7M0uvpp01juAQ--.23165S3", "X-Coremail-Antispam": "1UD129KBjvJXoW7KFy3Xr43KrWkGFW3tF1kKrg_yoW8ury5pF\n\t1DWFW5Gr13tFnFvw4DAwn8u34Fya4IyFZxGa9Fy34fCan8XrykKayqyryvqF109ws3CFyS\n\t9F4DtF429rWUArDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2\n\t9KBjDU0xBIdaVrnRJUUUHFb7Iv0xC_Zr1lb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I2\n\t0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI\n\t8067AKxVWUGwA2048vs2IY020Ec7CjxVAFwI0_Gr0_Xr1l8cAvFVAK0II2c7xJM28CjxkF\n\t64kEwVA0rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVWUCVW8JwA2z4x0Y4vE2Ix0cI8IcV\n\tCY1x0267AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIE14v26r4UJVWxJr1l84ACjcxK6I8E87Iv\n\t6xkF7I0E14v26r4UJVWxJr1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4\n\tCE5I8CrVC2j2WlYx0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvj\n\teVCFs4IE7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwACI402YVCY1x02628vn2kIc2xKxw\n\tAKzVCY07xG64k0F24lc7CjxVAaw2AFwI0_Jw0_GFyl42xK82IYc2Ij64vIr41l4c8EcI0E\n\tc7CjxVAaw2AFwI0_Jw0_GFyl4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxV\n\tWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r1q6r43MIIYrxkI\n\t7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r\n\t4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67AKxVWUJVW8JwCI\n\t42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuYvjxUI38nUUUUU", "X-CM-SenderInfo": "ysvqjiqsrsjkus6v33wo0lvxldqovvfxof0/1tbiAQUFEGn6CdtVhQAAsA" }, "content": "From: Zisen Ye <zisenye@stu.xidian.edu.cn>\n\nIf a server sends a truncated response but a large OutputBufferLength, and\nterminates the EA list early, check_wsl_eas() returns success without\nvalidating that the entire OutputBufferLength fits within iov_len.\n\nThen smb2_compound_op() does:\n memcpy(idata->wsl.eas, data[0], size[0]);\n\nWhere size[0] is OutputBufferLength. If iov_len is smaller than size[0],\nmemcpy can read beyond the end of the rsp_iov allocation and leak adjacent\nkernel heap memory.\n\nLink: https://lore.kernel.org/linux-cifs/d998240c-aca9-420d-9dbd-f5ba24af19e0@chenxiaosong.com/\nFixes: ea41367b2a60 (\"smb: client: introduce SMB2_OP_QUERY_WSL_EA\")\nCc: stable@vger.kernel.org\nSigned-off-by: Zisen Ye <zisenye@stu.xidian.edu.cn>\nReviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>\n---\n fs/smb/client/smb2inode.c | 12 ++++++++----\n 1 file changed, 8 insertions(+), 4 deletions(-)", "diff": "diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c\nindex 286912616c73..6c9c229b91f6 100644\n--- a/fs/smb/client/smb2inode.c\n+++ b/fs/smb/client/smb2inode.c\n@@ -111,7 +111,7 @@ static int check_wsl_eas(struct kvec *rsp_iov)\n \tu32 outlen, next;\n \tu16 vlen;\n \tu8 nlen;\n-\tu8 *end;\n+\tu8 *ea_end, *iov_end;\n \n \toutlen = le32_to_cpu(rsp->OutputBufferLength);\n \tif (outlen < SMB2_WSL_MIN_QUERY_EA_RESP_SIZE ||\n@@ -120,15 +120,19 @@ static int check_wsl_eas(struct kvec *rsp_iov)\n \n \tea = (void *)((u8 *)rsp_iov->iov_base +\n \t\t le16_to_cpu(rsp->OutputBufferOffset));\n-\tend = (u8 *)rsp_iov->iov_base + rsp_iov->iov_len;\n+\tea_end = (u8 *)ea + outlen;\n+\tiov_end = (u8 *)rsp_iov->iov_base + rsp_iov->iov_len;\n+\tif (ea_end > iov_end)\n+\t\treturn -EINVAL;\n+\n \tfor (;;) {\n-\t\tif ((u8 *)ea > end - sizeof(*ea))\n+\t\tif ((u8 *)ea > ea_end - sizeof(*ea))\n \t\t\treturn -EINVAL;\n \n \t\tnlen = ea->ea_name_length;\n \t\tvlen = le16_to_cpu(ea->ea_value_length);\n \t\tif (nlen != SMB2_WSL_XATTR_NAME_LEN ||\n-\t\t (u8 *)ea->ea_data + nlen + 1 + vlen > end)\n+\t\t (u8 *)ea->ea_data + nlen + 1 + vlen > ea_end)\n \t\t\treturn -EINVAL;\n \n \t\tswitch (vlen) {\n", "prefixes": [ "v4", "1/1" ] }