{"id":2224237,"url":"http://patchwork.ozlabs.org/api/1.2/patches/2224237/?format=json","web_url":"http://patchwork.ozlabs.org/project/linux-cifs-client/patch/20260417063426.1101332-1-rob_garcia@163.com/","project":{"id":12,"url":"http://patchwork.ozlabs.org/api/1.2/projects/12/?format=json","name":"Linux CIFS Client","link_name":"linux-cifs-client","list_id":"linux-cifs.vger.kernel.org","list_email":"linux-cifs@vger.kernel.org","web_url":"","scm_url":"","webscm_url":"","list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260417063426.1101332-1-rob_garcia@163.com>","list_archive_url":null,"date":"2026-04-17T06:34:26","name":"[5.15.y] smb: client: fix potential UAF in smb2_is_valid_oplock_break()","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"bf24c55ea2513b9e5c75173500deb35d94c475b4","submitter":{"id":93097,"url":"http://patchwork.ozlabs.org/api/1.2/people/93097/?format=json","name":"Robert Garcia","email":"rob_garcia@163.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/linux-cifs-client/patch/20260417063426.1101332-1-rob_garcia@163.com/mbox/","series":[{"id":500243,"url":"http://patchwork.ozlabs.org/api/1.2/series/500243/?format=json","web_url":"http://patchwork.ozlabs.org/project/linux-cifs-client/list/?series=500243","date":"2026-04-17T06:34:26","name":"[5.15.y] smb: client: fix potential UAF in smb2_is_valid_oplock_break()","version":1,"mbox":"http://patchwork.ozlabs.org/series/500243/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2224237/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2224237/checks/","tags":{},"related":[],"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","linux-cifs@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=163.com header.i=@163.com header.a=rsa-sha256\n header.s=s110527 header.b=oGut33ph;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=linux-cifs+bounces-10887-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=163.com header.i=@163.com\n header.b=\"oGut33ph\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=220.197.31.4","smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=163.com","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=163.com"],"Received":["from sto.lore.kernel.org (sto.lore.kernel.org\n [IPv6:2600:3c09:e001:a7::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxlWV1MjCz1yDF\n\tfor ; Fri, 17 Apr 2026 16:35:50 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id CC82D302FF2B\n\tfor ; Fri, 17 Apr 2026 06:35:47 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id F1CDA31F9AC;\n\tFri, 17 Apr 2026 06:35:43 +0000 (UTC)","from m16.mail.163.com (m16.mail.163.com [220.197.31.4])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 15591128816;\n\tFri, 17 Apr 2026 06:35:38 +0000 (UTC)","from pek-lpg-core5.wrs.com (unknown [])\n\tby gzga-smtp-mtada-g1-2 (Coremail) with SMTP id\n _____wDnjq9y1OFpB_qPAA--.5176S2;\n\tFri, 17 Apr 2026 14:34:27 +0800 (CST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776407743; cv=none;\n b=fRWhRVjVFA9vVPj/Y5sNfvzuQTYfAOeL1Hxx56JNTXA6T47C5iU1T2T9sPc5uM+TI93szDsNvm46wugT9b47flLJgjZjtIVV0KoDXtGD/Nr1AQK02dYpwKZ7dMr/Ge1pHu6qsiUHB6238swVMYrdbr7Di4q6TCENrM/hH80xrQ0=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776407743; c=relaxed/simple;\n\tbh=uhlGKAcdJqak0pqeS4lLWbOlmQP95VHdjPR8cq8278E=;\n\th=From:To:Cc:Subject:Date:Message-Id:MIME-Version;\n b=dyXVd7MsI6G5SBzy0+waEnhDHtJ0eKE35bWjBBJIGeoSLn64tkU9jAFR90MbdUN/QW4OPWKHUhpYasTb+eVby8O30Bz8Y10SVnGkG+Wnu7Mpy+voHoCEtQrQS181hyMCzHdqfjY/jI7q4nIXNttDQ8ziYOQRC6ipi+U5uk5jMZ0=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=163.com;\n spf=pass smtp.mailfrom=163.com;\n dkim=pass (1024-bit key) header.d=163.com header.i=@163.com\n header.b=oGut33ph; arc=none smtp.client-ip=220.197.31.4","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com;\n\ts=s110527; h=From:To:Subject:Date:Message-Id:MIME-Version; bh=K0\n\twju19S5OuVZqWd/KlWWwoyVnvimJ4E8sTVv29wXs0=; b=oGut33phEsL64aFDk5\n\tGzC4Qz/3656zvjzoAhUfOuK78HbkibFRfYG2lIcyqZ7bEgMHHbeG747uXmRPGMuj\n\toCdb4TbS+oFnvP1zzc0L5xdk7iF/c8VquobBpTsbkmYgvzUwXbVhlXVazWYz4ivZ\n\tG6uFYuFOoVemOflQO8CxzB9Sw=","From":"Robert Garcia ","To":"stable@vger.kernel.org,\n\tPaulo Alcantara ","Cc":"Steve French ,\n\tlinux-cifs@vger.kernel.org,\n\tsamba-technical@lists.samba.org,\n\tRobert Garcia ,\n\tlinux-kernel@vger.kernel.org","Subject":"[PATCH 5.15.y] smb: client: fix potential UAF in\n smb2_is_valid_oplock_break()","Date":"Fri, 17 Apr 2026 14:34:26 +0800","Message-Id":"<20260417063426.1101332-1-rob_garcia@163.com>","X-Mailer":"git-send-email 2.34.1","Precedence":"bulk","X-Mailing-List":"linux-cifs@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","X-CM-TRANSID":"_____wDnjq9y1OFpB_qPAA--.5176S2","X-Coremail-Antispam":"1Uf129KBjvdXoW7Xw1UAF15AF1UZryUZw15XFb_yoWDurb_Gr\n\t95JFy8Gr4rXFyrKF18Cr4aqryrGw1rK3Z3GrySkay8Jw1jgF1fJw4kK3Z5A395ur1DCry3\n\tu3s0yF98Wr13WjkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT\n\t9fnUUvcSsGvfC2KfnxnUUI43ZEXa7sRNGQ67UUUUU==","X-CM-SenderInfo":"5uresw5dufxti6rwjhhfrp/xtbC5RMkj2nh1HOQyAAA3q"},"content":"From: Paulo Alcantara \n\n[ Upstream commit 22863485a4626ec6ecf297f4cc0aef709bc862e4 ]\n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Paulo Alcantara (Red Hat) \nSigned-off-by: Steve French \n[ Appropriate path used. ]\nSigned-off-by: Robert Garcia \n---\n fs/cifs/smb2misc.c | 2 ++\n 1 file changed, 2 insertions(+)","diff":"diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c\nindex b84e682b4cae..da32b3f6686b 100644\n--- a/fs/cifs/smb2misc.c\n+++ b/fs/cifs/smb2misc.c\n@@ -679,6 +679,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)\n \t/* look up tcon based on tid & uid */\n \tspin_lock(&cifs_tcp_ses_lock);\n \tlist_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {\n+\t\tif (cifs_ses_exiting(ses))\n+\t\t\tcontinue;\n \t\tlist_for_each_entry(tcon, &ses->tcon_list, tcon_list) {\n \n \t\t\tspin_lock(&tcon->open_file_lock);\n","prefixes":["5.15.y"]}