kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
linux/fs
History
Frank Sorenson 62656b024e smb: client: fix ALIGN() overflow in symlink_data() error context loop 
The check added by commit 7d9a7f1f96 ("smb/client: fix possible
infinite loop and oob read in symlink_data()") compared the post-ALIGN
length against the remaining buffer, but ALIGN() itself can overflow:
for ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9), ALIGN(x, 8)
wraps to 0, so the subsequent bounds check passes, and the loop
advances by zero bytes leaving 'p' pointing into stale data.

Fix by checking the raw ErrorDataLength against the remaining space
before applying ALIGN(), then checking again after.  Since raw_len is
bounded by the buffer, raw_len + 7 cannot overflow, so the second check
is an exact post-alignment bounds guard.

Fixes: 76894f3e2f ("cifs: improve symlink handling for smb2+")
Cc: stable@vger.kernel.org
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
History 2026-08-24 17:08:53 -03:00
..
9p Asides of the avalanche of LLM-driven fixes, there are a couple of 2026-06-21 10:26:31 -07:00
adfs ARM development for 7.1-rc1 2026-04-25 07:44:26 -07:00
affs affs: handle set_blocksize failures 2026-05-21 13:39:35 +02:00
afs afs: Fix UAF when sending a message 2026-07-28 09:20:44 +02:00
autofs vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
befs befs: handle set_blocksize failures 2026-05-21 13:39:35 +02:00
bfs bfs: replace get_zeroed_page() with kzalloc() 2026-05-28 13:58:14 +02:00
btrfs for-7.2-rc6-fixup-worker-tag 2026-08-06 13:29:15 -07:00
cachefiles cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE 2026-07-01 15:26:28 +02:00
ceph ceph: avoid fs reclaim while using current->journal_info 2026-07-23 20:29:42 +02:00
coda coda cleanups and fixes 2026-04-21 14:03:10 -07:00
configfs configfs work 2026-06-15 04:28:20 +05:30
cramfs cramfs: drop obsolete Future Development notes and update tools URL 2026-05-03 09:12:23 -06:00
crypto fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() 2026-07-28 21:19:44 -07:00
debugfs debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() 2026-04-02 16:15:23 +02:00
devpts Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dlm dlm: init per node debugfs before add to node hash 2026-05-08 08:38:03 -05:00
ecryptfs The set of eCryptfs changes for the 7.2-rc1 merge window consists of: 2026-06-26 08:24:06 -07:00
efivarfs efivarfs: use QSTR() in efivarfs_alloc_dentry 2026-04-28 12:30:59 +02:00
efs fs: efs: remove unneeded debug prints 2026-06-11 11:42:21 -07:00
erofs erofs: cap LZMA stream pool size 2026-07-27 12:31:11 +08:00
exfat iomap: consolidate bio submission 2026-07-01 15:26:47 +02:00
exportfs find_acceptable_alias(): skip NORCU aliases with zero refcount 2026-06-05 00:34:55 -04:00
ext2 ext2: fix ignored return value of generic_write_sync() 2026-06-02 10:56:16 +02:00
ext4 Various ext4 updates for 7.2-rc1: 2026-06-18 09:42:02 -07:00
f2fs fscrypt: Avoid dynamic allocation in fscrypt_get_devices() 2026-07-20 10:39:24 -07:00
fat fat: avoid stack overflow warning 2026-07-09 15:48:55 -07:00
freevxfs freevxfs: don't BUG() on unknown typed-extent type 2026-07-01 15:26:26 +02:00
fuse fuse: call fuse_send_readpages explicitly from fuse_readahead 2026-07-01 15:26:47 +02:00
gfs2 gfs2 fixes 2026-06-26 15:13:06 -07:00
hfs hfs/hfsplus updates for v7.2 2026-06-16 12:27:23 +05:30
hfsplus hfs/hfsplus updates for v7.2 2026-06-16 12:27:23 +05:30
hostfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hpfs vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
hugetlbfs mm: use mapping_mapped to simplify the code 2026-06-21 11:37:38 -07:00
iomap iomap: add a separate bio_set for iomap_split_ioend 2026-07-31 11:49:09 +02:00
isofs \n 2026-06-16 11:58:52 +05:30
jbd2 Various ext4 updates for 7.2-rc1: 2026-06-18 09:42:02 -07:00
jffs2 treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
jfs vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
kernfs Driver core changes for 7.2-rc1 2026-06-15 12:41:17 +05:30
lockd lockd: fix NLMv3 GRANTED_MSG handling 2026-07-17 09:31:50 -04:00
minix minix: avoid overflow in bitmap block count calculation 2026-07-01 15:26:24 +02:00
netfs netfs: Fix folio_queue ENOMEM in writeback by adding a mempool 2026-07-28 15:42:31 +02:00
nfs NFSv4.2: fix nfs4_listxattr size accounting 2026-07-31 13:27:25 -04:00
nfs_common NFSD: Remove NFSERR_EAGAIN 2026-01-02 13:43:41 -05:00
nfsd nfsd-7.2 fixes: 2026-07-13 08:38:01 -07:00
nilfs2 nilfs2 updates for v7.2 2026-06-16 12:14:20 +05:30
nls fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() 2025-12-01 11:58:06 +02:00
notify \n 2026-06-16 11:56:43 +05:30
ntfs ntfs: drop stale page-cache when shrinking a non-resident attr 2026-07-21 18:48:24 +09:00
ntfs3 iomap: consolidate bio submission 2026-07-01 15:26:47 +02:00
ocfs2 ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset 2026-07-20 17:41:28 -07:00
omfs omfs: handle set_blocksize failures 2026-05-21 13:39:36 +02:00
openpromfs Coccinelle-based conversion to use ->i_state accessors 2025-10-20 20:22:26 +02:00
orangefs orangefs: keep the readdir entry size 64-bit in fill_from_part() 2026-07-01 15:26:27 +02:00
overlayfs ovl: check access to copy_file_range source with src mounter creds 2026-07-22 16:42:28 +02:00
proc 13 hotfixes. All are cc:stable. 11 are for MM. All are singletons - 2026-07-27 14:36:26 -07:00
pstore mm.git review status for linus..mm-stable 2026-04-15 12:59:16 -07:00
qnx4 qnx4: handle set_blocksize failures 2026-05-21 13:39:35 +02:00
qnx6 fs/qnx6: fix pointer arithmetic in directory iteration 2026-05-28 14:16:33 +02:00
quota quota: allocate dquot_hash with kmalloc() 2026-05-27 15:12:22 +02:00
ramfs folio_batch: rename pagevec.h to folio_batch.h 2026-04-05 13:53:07 -07:00
resctrl fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list 2026-07-06 19:05:49 -07:00
romfs mm.git review status for linus..mm-stable 2026-02-18 20:50:32 -08:00
smb smb: client: fix ALIGN() overflow in symlink_data() error context loop 2026-08-24 17:08:53 -03:00
squashfs Squashfs: check metadata block offset is within range 2026-02-24 11:13:27 -08:00
sysfs Driver core changes for 7.2-rc1 2026-06-15 12:41:17 +05:30
tests fs/tests: exec: Remove bad test vector 2026-03-18 11:41:53 -07:00
tracefs eventfs: Use children field for rcu head and add memory barriers 2026-08-08 10:36:05 -04:00
ubifs fs: add icount_read_once() and stop open-coding ->i_count loads 2026-05-11 23:12:28 +02:00
udf \n 2026-06-16 11:58:52 +05:30
ufs vfs-7.1-rc1.bh.metadata 2026-04-13 12:46:42 -07:00
unicode Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vboxsf vboxsf: Implement fileattr_get for case sensitivity 2026-05-11 16:50:29 +02:00
verity fsverity: Fix silent truncation in bpf_get_fsverity_digest() 2026-08-04 09:24:23 +02:00
xfs xfs: fixes for 7.2-rc7 2026-08-06 08:16:40 -07:00
zonefs zonefs: handle integer overflow in zonefs_fname_to_fno 2026-05-12 07:53:20 +09:00
aio.c libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers 2026-06-04 10:10:49 +02:00
anon_inodes.c libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers 2026-06-04 10:10:49 +02:00
attr.c fs,fsverity: remove check for fsverity being enabled in setattr_prepare() 2026-07-28 21:25:03 -07:00
backing-file.c backing-file: fix backing_file_open() kerneldoc parameter 2026-06-10 09:49:25 +02:00
bad_inode.c fs: refactor ->update_time handling 2026-01-12 14:01:32 +01:00
binfmt_elf.c mm: unexport vm_brk_flags() and eliminate vm_flags parameter 2026-04-05 13:53:39 -07:00
binfmt_elf_fdpic.c binfmt_elf_fdpic: only honour the first PT_INTERP 2026-07-21 13:22:34 +02:00
binfmt_flat.c binfmt_flat: Fix integer overflow bug on 32 bit systems 2025-01-10 08:49:05 -08:00
binfmt_misc.c binfmt_misc: don't leak the user namespace when the mount fails 2026-07-28 15:51:25 +02:00
binfmt_script.c fs: binfmt: add missing MODULE_DESCRIPTION() macros 2024-05-28 12:06:51 +02:00
bpf_fs_kfuncs.c bpf: have bpf_real_data_inode() take a struct file 2026-07-01 15:26:27 +02:00
buffer.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
char_dev.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
compat_binfmt_elf.c binfmt_elf: Wire up AT_HWCAP3 at AT_HWCAP4 2024-10-17 18:38:49 +01:00
coredump.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
d_path.c dcache: permit dynamic_dname()s up to NAME_MAX 2026-04-07 12:32:22 +02:00
dax.c dax changes for 7.1 2026-04-21 14:12:01 -07:00
dcache.c dentry memory safety stuff 2026-06-15 04:15:31 +05:30
direct-io.c direct-io: remove IOCB_NOWAIT support 2026-05-26 11:01:55 -06:00
drop_caches.c Coccinelle-based conversion to use ->i_state accessors 2025-10-20 20:22:26 +02:00
eventfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
eventpoll.c eventpoll: pin files while checking reverse paths 2026-07-23 12:48:22 +02:00
exec.c exec: fix unsigned loop counter wrap in transfer_args_to_stack() 2026-07-21 13:00:49 +02:00
fcntl.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
fhandle.c fhandle: reject detached mounts in capable_wrt_mount() 2026-07-01 15:26:32 +02:00
file.c fs: retire stale comment in fget_task_next() 2026-05-28 14:27:00 +02:00
file_attr.c fs: Add case sensitivity flags to file_kattr 2026-05-11 16:50:27 +02:00
file_table.c dentry memory safety stuff 2026-06-15 04:15:31 +05:30
filesystems.c fs: fix ups and tidy ups to /proc/filesystems caching 2026-06-12 14:26:27 +02:00
fs-writeback.c mm: kick writeback flusher for IOCB_DONTCACHE with targeted dirty tracking 2026-06-04 10:16:51 +02:00
fs_context.c vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
fs_dirent.c fs: rename fs_types.h to fs_dirent.h 2025-11-05 09:51:30 +01:00
fs_parser.c fs: remove fsparam_path / fs_param_is_path 2026-02-19 14:34:26 +01:00
fs_pin.c switch the remnants of releasing the mountpoint away from fs_pin 2019-07-16 22:52:37 -04:00
fs_struct.c fs: add <linux/init_task.h> for 'init_fs' 2026-01-14 16:50:37 +01:00
fserror.c treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
fsopen.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
init.c struct filename series 2026-02-09 16:58:28 -08:00
inode.c mm.git review status for linus..mm-stable 2026-06-23 12:03:44 -07:00
internal.h fuse: invalidate page cache after DIO and async DIO writes 2026-06-15 14:06:20 +02:00
ioctl.c fs: remove vfs_ioctl export 2025-09-01 13:08:01 +02:00
Kconfig treewide: fix indentation and whitespace in Kconfig files 2026-05-28 21:24:42 -07:00
Kconfig.binfmt binfmt_elf: preserve original ELF e_flags for core dumps 2025-09-03 20:49:32 -07:00
kernel_read_file.c fdget(), trivial conversions 2024-11-03 01:28:06 -05:00
libfs.c This series converts a bunch of unidiomatic uses of d_add() 2026-06-15 04:21:00 +05:30
locks.c filelock: add an inode_lease_ignore_mask helper 2026-05-15 19:24:32 +02:00
Makefile userfaultfd: merge fs/userfaultfd.c into mm/userfaultfd.c 2026-06-04 14:45:03 -07:00
mbcache.c vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
mnt_idmapping.c fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap 2026-05-11 14:19:01 +02:00
mount.h vfs-7.2-rc1.procfs 2026-06-15 04:07:58 +05:30
mpage.c mm.git review status for linus..mm-stable 2026-04-15 12:59:16 -07:00
namei.c fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid 2026-07-01 15:26:18 +02:00
namespace.c vfs-7.2-rc1.procfs 2026-06-15 04:07:58 +05:30
nsfs.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
nullfs.c fs: add immutable rootfs 2026-01-12 16:52:09 +01:00
open.c mm.git review status for linus..mm-stable 2026-06-23 12:03:44 -07:00
pidfs.c pidfs: make pidfs_ino_lock static 2026-07-24 10:30:58 +02:00
pipe.c fs/pipe: pre-allocate pages outside pipe->mutex in anon_pipe_write 2026-05-28 14:33:24 +02:00
pnode.c umount_tree(): take all victims out of propagation graph at once 2025-09-15 21:26:44 -04:00
pnode.h umount_tree(): take all victims out of propagation graph at once 2025-09-15 21:26:44 -04:00
posix_acl.c fs: preserve ACL_DONT_CACHE state in forget_cached_acl() 2026-07-21 21:52:51 +02:00
proc_namespace.c ->mnt_devname is never NULL 2025-05-23 14:20:44 +02:00
read_write.c fs/read_write: Do not export __kernel_write() to the entire world 2026-06-05 14:46:20 +02:00
readdir.c fs: Replace user_access_{begin/end} by scoped user access 2026-03-24 14:44:02 +01:00
remap_range.c convert vfs_dedupe_file_range(). 2024-11-03 01:28:07 -05:00
select.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
seq_file.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
signalfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
splice.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
stack.c docs/vfs: update references to i_mutex to i_rwsem 2025-06-23 12:17:33 +02:00
stat.c statx: switch to CLASS(filename_maybe_null) 2026-01-16 12:52:04 -05:00
statfs.c user_statfs(): switch to CLASS(filename) 2026-01-16 12:52:04 -05:00
super.c super: fix emergency thaw deadlock on frozen block devices 2026-07-26 17:08:52 +02:00
sync.c sync_file_range: delete dead S_ISLNK code 2026-05-21 13:39:36 +02:00
sysctls.c treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
timerfd.c fs/timerfd: Use the new alarm/hrtimer functions 2026-05-01 21:36:13 +02:00
utimes.c do_utimes_path(): switch to CLASS(filename_uflags) 2026-01-16 12:52:03 -05:00
xattr.c lsm/stable-7.2 PR 20260615 2026-06-17 12:34:16 +01:00