{"id":2215645,"url":"http://patchwork.ozlabs.org/api/patches/2215645/?format=json","web_url":"http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260325004650.425602-2-tim.whisonant@canonical.com/","project":{"id":15,"url":"http://patchwork.ozlabs.org/api/projects/15/?format=json","name":"Ubuntu Kernel","link_name":"ubuntu-kernel","list_id":"kernel-team.lists.ubuntu.com","list_email":"kernel-team@lists.ubuntu.com","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260325004650.425602-2-tim.whisonant@canonical.com>","list_archive_url":null,"date":"2026-03-25T00:46:47","name":"[SRU,J,1/1] smb: client: fix potential UAF in smb2_is_network_name_deleted()","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"bd15f12f90da7609d53f2cc7f81c2a7c54c3addd","submitter":{"id":89903,"url":"http://patchwork.ozlabs.org/api/people/89903/?format=json","name":"Tim Whisonant","email":"tim.whisonant@canonical.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260325004650.425602-2-tim.whisonant@canonical.com/mbox/","series":[{"id":497362,"url":"http://patchwork.ozlabs.org/api/series/497362/?format=json","web_url":"http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=497362","date":"2026-03-25T00:46:46","name":"[SRU,J,1/1] smb: client: fix potential UAF in smb2_is_network_name_deleted()","version":1,"mbox":"http://patchwork.ozlabs.org/series/497362/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2215645/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2215645/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=K/+jhowe;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fgSsr4RCPz1xy3\n\tfor ; Wed, 25 Mar 2026 11:47:11 +1100 (AEDT)","from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from )\n\tid 1w5COl-0001pO-68; Wed, 25 Mar 2026 00:47:03 +0000","from smtp-relay-internal-0.internal ([10.131.114.225]\n helo=smtp-relay-internal-0.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from )\n id 1w5COi-0001o2-VP\n for kernel-team@lists.ubuntu.com; Wed, 25 Mar 2026 00:47:01 +0000","from mail-yw1-f198.google.com (mail-yw1-f198.google.com\n [209.85.128.198])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id C63FF3F293\n for ; Wed, 25 Mar 2026 00:47:00 +0000 (UTC)","by mail-yw1-f198.google.com with SMTP id\n 00721157ae682-79ac9fad874so20805327b3.2\n for ; Tue, 24 Mar 2026 17:47:00 -0700 (PDT)","from localhost (104-6-108-11.lightspeed.frokca.sbcglobal.net.\n [104.6.108.11]) by smtp.gmail.com with ESMTPSA id\n 00721157ae682-79a90580d7csm79641057b3.37.2026.03.24.17.46.58\n for \n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Tue, 24 Mar 2026 17:46:58 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1774399620;\n bh=IvoW0d8ttoxLAOm6//vCeX2mLpQqgW0TG7kR76CKggE=;\n h=From:To:Subject:Date:Message-ID:In-Reply-To:References:\n MIME-Version;\n b=K/+jhoweP0eO0LmNXvwjNaVqN4EaRwGF3TlWrAuhnbMQHcvHDMPTKkFVjnmA+kWJ8\n SmRMVIijzS5EtLEo4ocZBXQTPKrOZZwnGa3fOXEyd8hODMQGFC86fkKJK8VSM9NDrm\n HZ5LEjKAb0OMFhdsgTCdn2E9Jb/HU07bsTpTOwlNpYFlRTBmyf7am/h316KbY6JIFD\n ot7RlaNPeRqjT/tGbjhs2qRtZo6mfYk2ELkk49AGQQvco05BEBioQiym7Zlo2Hhqdh\n guwA4m97dQXCtsZmzdS5GW/kzvK/6oatguAkTU94wV21z55l0jPPxfswlEJEhS/rZ0\n U1j1ljcfDjSr/3t4vNiDpGvh4ntctUTSwaBGSP045lGE2YyBJAIbPbfsUdWfeR5GVJ\n uEZuX/b1Wk6qn02QZwgFu4yDsgALZScGfsxyZv48evApcVbs07H+E588u/0OEtIqBY\n gXEVTqsmzhRsGhIF4ykn8lgvzAqR+V4Q3Fa1RGsNgKBq9tAU1kpEaLfUiBps46yRnC\n 7P69wtVVuoeRQ6phn/msED//SxOn2d6L/j7QMxuhlsdABKjRGGdl2IstfLJwLwHp+s\n yq6O2AATQRgZQMAAM9aJCnGBFBZpE1ac128PVhkpbGNcH0sT9RXZ68KdVZs9FQ3s8J\n Na/JheHX4IfGOEezmG2BnfHw=","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1774399619; x=1775004419;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to\n :cc:subject:date:message-id:reply-to;\n bh=IvoW0d8ttoxLAOm6//vCeX2mLpQqgW0TG7kR76CKggE=;\n b=BD7phbxwRHjGU2CidPfAb6aqZU+91Ki5fmT51qdEYatS/qBer7rNkHyAOt4FJnYika\n p4SgcKO2rMkpM1iOAwt3zxjKk6uJrJfD24wjR2jKEm3twvGmUp3kZ0Mr5gNbhWwNoEH0\n 3nmKF5wWy3DWXaE4sE2jJwLblx2ULRGtPQ/IFZLERUb9qX6rgCt1z45hf2uY9uGDSTKI\n wWeJ6nXNU9T7v0qGRavM7dnHGV1rH7MKv90/U04KwsllZi7GrtnjgP93oNEtiuaLZMSS\n MJChfwdN9NDGgutMXsmrDQEejkM60vApNfWML+BF4RuzshCTTBEp4xY/iQV4BvAl31+c\n 0W7g==","X-Gm-Message-State":"AOJu0YznJdej8SRQTm7TRGEKPK5zDa5V81nRhWKJC31RbewHJWisr2Fl\n TI4LW6o8xpxefwQITjS4JIIHra/9kTE9sO9JNiACzLMwKFz0ApDUyx6H8KPYkPU26M7OaYcfFyC\n wL9B6JpTjjfpMPORSsMjUJ/RTQydu57iXnMxhUpJtpHZU9sgFh8rytU8KAf1bA0wENsuJgLVejf\n wDVBmCNCD1q9b18g==","X-Gm-Gg":"ATEYQzzWm/XgXt9eROpp1RMPX5owS3ZaGUYJXy+tsCT6esPfOl5CjiFZGsQYKdN9uKs\n t5Y/VTCR1QaksOxfl+y2eghJbnG0nqZ3H0zQ0zTUYhxrldZIIQW6V4bJOImpBr4j4boC+SzjsVc\n irxD+RMvqi+jNxSK84g8h27pSKrZwikQwcSijDVQp1/44Q+dumR2kc3KNfAjfUyYDoaBBJbdKJo\n SpgJitS0iaflXeh/DyjDr5Q3GdzC6HnqT6nOxySbwTKiUWwUJv+o3RcR5oqHg31nVJPLL1xVap2\n fXJz0pmbrnWrE9l6h2bDR8ANmwI0fAECnuS0zrZcTi4fCVFoySlf0byf2umWWZ0siWZZ9UI+JEA\n 5dH+5N4Dfm0ISwliW5x1Y14ZI4ZuG9QX4amn2jtdoVHQFFCKP2zt/parA7MigrAcix6NpDsS4St\n 29cQ==","X-Received":["by 2002:a05:690c:660e:b0:798:769e:ec44 with SMTP id\n 00721157ae682-79acf68aa0fmr19638287b3.54.1774399619401;\n Tue, 24 Mar 2026 17:46:59 -0700 (PDT)","by 2002:a05:690c:660e:b0:798:769e:ec44 with SMTP id\n 00721157ae682-79acf68aa0fmr19637997b3.54.1774399618996;\n Tue, 24 Mar 2026 17:46:58 -0700 (PDT)"],"From":"Tim Whisonant ","To":"kernel-team@lists.ubuntu.com","Subject":"[SRU][J][PATCH 1/1] smb: client: fix potential UAF in\n smb2_is_network_name_deleted()","Date":"Tue, 24 Mar 2026 17:46:47 -0700","Message-ID":"<20260325004650.425602-2-tim.whisonant@canonical.com>","X-Mailer":"git-send-email 2.43.0","In-Reply-To":"<20260325004650.425602-1-tim.whisonant@canonical.com>","References":"<20260325004650.425602-1-tim.whisonant@canonical.com>","MIME-Version":"1.0","X-BeenThere":"kernel-team@lists.ubuntu.com","X-Mailman-Version":"2.1.20","Precedence":"list","List-Id":"Kernel team discussions ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"base64","Errors-To":"kernel-team-bounces@lists.ubuntu.com","Sender":"\"kernel-team\" "},"content":"From: Paulo Alcantara \n\nSkip sessions that are being teared down (status == SES_EXITING) to\navoid UAF.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Paulo Alcantara (Red Hat) \nSigned-off-by: Steve French \n(backported from commit 63981561ffd2d4987807df4126f96a11e18b0c1d)\n[tswhison: context adjustment due to missing commit\n9543c8ab301 (\"cifs: list_for_each() -> list_for_each_entry()\")]\nCVE-2024-35862\nSigned-off-by: Tim Whisonant \n---\n fs/cifs/smb2ops.c | 2 ++\n 1 file changed, 2 insertions(+)","diff":"diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c\nindex 1151a7cac552c..f4d0bff64d053 100644\n--- a/fs/cifs/smb2ops.c\n+++ b/fs/cifs/smb2ops.c\n@@ -2560,6 +2560,8 @@ smb2_is_network_name_deleted(char *buf, struct TCP_Server_Info *server)\n \tspin_lock(&cifs_tcp_ses_lock);\n \tlist_for_each(tmp, &server->smb_ses_list) {\n \t\tses = list_entry(tmp, struct cifs_ses, smb_ses_list);\n+\t\tif (cifs_ses_exiting(ses))\n+\t\t\tcontinue;\n \t\tlist_for_each(tmp1, &ses->tcon_list) {\n \t\t\ttcon = list_entry(tmp1, struct cifs_tcon, tcon_list);\n \t\t\tif (tcon->tid == shdr->TreeId) {\n","prefixes":["SRU","J","1/1"]}