From: Greg Kroah-Hartman Date: Sun, 7 Sep 2025 15:23:50 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.4.299~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6b8f68fcae901261e05a39f87637deb18a65c603;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: cifs-fix-integer-overflow-in-match_server.patch --- diff --git a/queue-5.4/cifs-fix-integer-overflow-in-match_server.patch b/queue-5.4/cifs-fix-integer-overflow-in-match_server.patch new file mode 100644 index 0000000000..ce7f295471 --- /dev/null +++ b/queue-5.4/cifs-fix-integer-overflow-in-match_server.patch @@ -0,0 +1,46 @@ +From stable+bounces-178047-greg=kroah.com@vger.kernel.org Sun Sep 7 17:08:42 2025 +From: Sasha Levin +Date: Sun, 7 Sep 2025 11:08:36 -0400 +Subject: cifs: fix integer overflow in match_server() +To: stable@vger.kernel.org +Cc: Roman Smirnov , Steve French , Sasha Levin +Message-ID: <20250907150836.640197-1-sashal@kernel.org> + +From: Roman Smirnov + +[ Upstream commit 2510859475d7f46ed7940db0853f3342bf1b65ee ] + +The echo_interval is not limited in any way during mounting, +which makes it possible to write a large number to it. This can +cause an overflow when multiplying ctx->echo_interval by HZ in +match_server(). + +Add constraints for echo_interval to smb3_fs_context_parse_param(). + +Found by Linux Verification Center (linuxtesting.org) with Svace. + +Fixes: adfeb3e00e8e1 ("cifs: Make echo interval tunable") +Cc: stable@vger.kernel.org +Signed-off-by: Roman Smirnov +Signed-off-by: Steve French +[ Adapted to older CIFS filesystem structure and mount option parsing ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/connect.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2144,6 +2144,11 @@ cifs_parse_mount_options(const char *mou + __func__); + goto cifs_parse_mount_err; + } ++ if (option < SMB_ECHO_INTERVAL_MIN || ++ option > SMB_ECHO_INTERVAL_MAX) { ++ cifs_dbg(VFS, "echo interval is out of bounds\n"); ++ goto cifs_parse_mount_err; ++ } + vol->echo_interval = option; + break; + case Opt_snapshot: diff --git a/queue-5.4/series b/queue-5.4/series index 6dc9ed1859..643e257284 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -41,3 +41,4 @@ pcmcia-add-error-handling-for-add_interval-in-do_val.patch spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch +cifs-fix-integer-overflow-in-match_server.patch