5.4-stable patches

added patches:
	cifs-fix-integer-overflow-in-match_server.patch

diff --git a/queue-5.4/cifs-fix-integer-overflow-in-match_server.patch b/queue-5.4/cifs-fix-integer-overflow-in-match_server.patch
new file mode 100644 (file)
index 0000000..ce7f295
--- /dev/null
+++ b/queue-5.4/cifs-fix-integer-overflow-in-match_server.patch
@@ -0,0 +1,46 @@
+From stable+bounces-178047-greg=kroah.com@vger.kernel.org Sun Sep  7 17:08:42 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun,  7 Sep 2025 11:08:36 -0400
+Subject: cifs: fix integer overflow in match_server()
+To: stable@vger.kernel.org
+Cc: Roman Smirnov <r.smirnov@omp.ru>, Steve French <stfrench@microsoft.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250907150836.640197-1-sashal@kernel.org>
+
+From: Roman Smirnov <r.smirnov@omp.ru>
+
+[ Upstream commit 2510859475d7f46ed7940db0853f3342bf1b65ee ]
+
+The echo_interval is not limited in any way during mounting,
+which makes it possible to write a large number to it. This can
+cause an overflow when multiplying ctx->echo_interval by HZ in
+match_server().
+
+Add constraints for echo_interval to smb3_fs_context_parse_param().
+
+Found by Linux Verification Center (linuxtesting.org) with Svace.
+
+Fixes: adfeb3e00e8e1 ("cifs: Make echo interval tunable")
+Cc: stable@vger.kernel.org
+Signed-off-by: Roman Smirnov <r.smirnov@omp.ru>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+[ Adapted to older CIFS filesystem structure and mount option parsing ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/cifs/connect.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2144,6 +2144,11 @@ cifs_parse_mount_options(const char *mou
+                                        __func__);
+                               goto cifs_parse_mount_err;
+                       }
++                      if (option < SMB_ECHO_INTERVAL_MIN ||
++                          option > SMB_ECHO_INTERVAL_MAX) {
++                              cifs_dbg(VFS, "echo interval is out of bounds\n");
++                              goto cifs_parse_mount_err;
++                      }
+                       vol->echo_interval = option;
+                       break;
+               case Opt_snapshot:

diff --git a/queue-5.4/series b/queue-5.4/series
index 6dc9ed18598bddb6721a28c1466e71439d12d6be..643e257284fd6718bec52b554ef3e51451a1f26e 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -41,3 +41,4 @@ pcmcia-add-error-handling-for-add_interval-in-do_val.patch
 spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch
 spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch
 spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch
+cifs-fix-integer-overflow-in-match_server.patch