From 0d5eea21cb7964765baa59c8bfa3fdfcef6f9864 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Fri, 30 Aug 2024 14:38:34 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...-of-smb2-query-dir-response-has-at-l.patch | 40 +++++++++++++++++++ queue-5.15/series | 1 + 2 files changed, 41 insertions(+) create mode 100644 queue-5.15/ksmbd-the-buffer-of-smb2-query-dir-response-has-at-l.patch diff --git a/queue-5.15/ksmbd-the-buffer-of-smb2-query-dir-response-has-at-l.patch b/queue-5.15/ksmbd-the-buffer-of-smb2-query-dir-response-has-at-l.patch new file mode 100644 index 00000000000..f6f66fad456 --- /dev/null +++ b/queue-5.15/ksmbd-the-buffer-of-smb2-query-dir-response-has-at-l.patch @@ -0,0 +1,40 @@ +From 50f20b1d64076cd63bbc32b19f97968b547e7f2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2024 22:07:38 +0900 +Subject: ksmbd: the buffer of smb2 query dir response has at least 1 byte + +From: Namjae Jeon + +[ Upstream commit ce61b605a00502c59311d0a4b1f58d62b48272d0 ] + +When STATUS_NO_MORE_FILES status is set to smb2 query dir response, +->StructureSize is set to 9, which mean buffer has 1 byte. +This issue occurs because ->Buffer[1] in smb2_query_directory_rsp to +flex-array. + +Fixes: eb3e28c1e89b ("smb3: Replace smb2pdu 1-element arrays with flex-arrays") +Cc: stable@vger.kernel.org # v6.1+ +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/ksmbd/smb2pdu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index 57f59172d8212..3458f2ae5cee4 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -4160,7 +4160,8 @@ int smb2_query_dir(struct ksmbd_work *work) + rsp->OutputBufferLength = cpu_to_le32(0); + rsp->Buffer[0] = 0; + rc = ksmbd_iov_pin_rsp(work, (void *)rsp, +- sizeof(struct smb2_query_directory_rsp)); ++ offsetof(struct smb2_query_directory_rsp, Buffer) ++ + 1); + if (rc) + goto err_out; + } else { +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 6fdcfdaf02d..2bfd114788f 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -184,3 +184,4 @@ drm-amdkfd-don-t-allow-mapping-the-mmio-hdp-page-with-large-pages.patch ata-libata-core-fix-null-pointer-dereference-on-error.patch cgroup-cpuset-prevent-uaf-in-proc_cpuset_show.patch net-rds-fix-possible-deadlock-in-rds_message_put.patch +ksmbd-the-buffer-of-smb2-query-dir-response-has-at-l.patch -- 2.47.3