FAILED: patch "[PATCH] smb: client: reject a tree connect response whose byte count" failed to apply to 6.6-stable tree

PATCH New [email protected] 2 participants 5 messages Sep 3 – Sep 7

Subsystems (4)

Stable branch VFS SMB client (CIFS) Kernel SMB3 server (ksmbd)

lore

Share & tools

lore

[email protected]

author maintainer

2026-09-03 13:49 UTC #0 lore raw

The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 65deb18359341141d37dc86fc7853511be3c87a7
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090336-riverboat-makeover-fe69@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 65deb18359341141d37dc86fc7853511be3c87a7 Mon Sep 17 00:00:00 2001
From: Bryam Vargas <[email protected]>
Date: Fri, 21 Aug 2026 07:36:16 -0500
Subject: [PATCH] smb: client: reject a tree connect response whose byte count
is too small

CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a huge size_t. The later subtraction wraps the __u16 bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the slab object, and the bytes reach userspace through tcon->nativeFileSystem in /proc/fs/cifs/DebugData.

Reject a byte area too small for what the parser consumes. Two bytes is the least it can consume, and no conformant response carries fewer. The new trace point is the 129th smb_eio_trace entry, which __mode(byte) cannot represent, so the attribute goes with it.

Fixes cc20c031bb06 ("cifs: convert CIFSTCon to use new unicode helper functions")

Cc [email protected]

Signed-off-by Bryam Vargas <[email protected]>

Reviewed-by Namjae Jeon <[email protected]>

Signed-off-by Paulo Alcantara <[email protected]>

fs/smb/client/cifssmb.c +6 -0

index 1f77512252e7..f5aad5f61dce 100644
@@ -615,6 +615,11 @@ CIFSTCon(const unsigned int xid, struct cifs_ses *ses,
 		tcon->tid = smb_buffer_response->Tid;
 		bcc_ptr = pByteArea(smb_buffer_response);
 		bytes_left = get_bcc(smb_buffer_response);
+		if (bytes_left < 2) {
+			rc = smb_EIO2(smb_eio_trace_tcon_bcc_too_small,
+				      bytes_left, 2);
+			goto out;
+		}
 		length = strnlen(bcc_ptr, bytes_left - 2);
 		if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
 			is_unicode = true;

@@ -670,6 +675,7 @@ CIFSTCon(const unsigned int xid, struct cifs_ses *ses,
 			reset_cifs_unix_caps(xid, tcon, NULL, NULL);
 		}
 	}
+out:
 	cifs_buf_release(smb_buffer);
 	return rc;
 }

fs/smb/client/trace.h +2 -1

index 5b21ad3c15fb..12241abb8e2e 100644
@@ -133,6 +133,7 @@
 	EM(smb_eio_trace_sym_slash,			"sym_slash") \
 	EM(smb_eio_trace_sym_target_len,		"sym_target_len") \
 	EM(smb_eio_trace_symlink_file_size,		"symlink_file_size") \
+	EM(smb_eio_trace_tcon_bcc_too_small,		"tcon_bcc_too_small") \
 	EM(smb_eio_trace_tdis_in_reconnect,		"tdis_in_reconnect") \
 	EM(smb_eio_trace_tx_chained_async,		"tx_chained_async") \
 	EM(smb_eio_trace_tx_compress_failed,		"tx_compress_failed") \

@@ -213,7 +214,7 @@
 #define EM(a, b) a,
 #define E_(a, b) a
 
-enum smb_eio_trace		{ smb_eio_traces } __mode(byte);
+enum smb_eio_trace		{ smb_eio_traces };
 enum smb3_rw_credits_trace	{ smb3_rw_credits_traces } __mode(byte);
 enum smb3_tcon_ref_trace	{ smb3_tcon_ref_traces } __mode(byte);

Sasha Levin

maintainer

2026-09-07 21:36 UTC #1 lore raw

PATCH 1/4 cifs: Scripted clean up fs/smb/client/fscache.h

From: David Howells <[email protected]>

[ Upstream commit bc3de356aae666de5d8b5131545be87cf7754431 ]

Remove externs, correct argument names and reformat declarations.

Signed-off-by David Howells <[email protected]>

cc Steve French <[email protected]>

cc Paulo Alcantara <[email protected]>

cc Enzo Matsumiya <[email protected]>

cc [email protected]

Acked-by Enzo Matsumiya <[email protected]>

Signed-off-by Steve French <[email protected]>

Stable-dep-of: 65deb1835934 ("smb: client: reject a tree connect response whose byte count is too small")

Signed-off-by Sasha Levin <[email protected]>

---
 fs/smb/client/fscache.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

fs/smb/client/fscache.h +5 -5

index 1f2ea9f5cc9a8..4c2e269a268ed 100644
@@ -38,12 +38,12 @@ struct cifs_fscache_inode_coherency_data {
 /*
  * fscache.c
  */
-extern int cifs_fscache_get_super_cookie(struct cifs_tcon *);
-extern void cifs_fscache_release_super_cookie(struct cifs_tcon *);
+int cifs_fscache_get_super_cookie(struct cifs_tcon *tcon);
+void cifs_fscache_release_super_cookie(struct cifs_tcon *tcon);
 
-extern void cifs_fscache_get_inode_cookie(struct inode *inode);
-extern void cifs_fscache_release_inode_cookie(struct inode *);
-extern void cifs_fscache_unuse_inode_cookie(struct inode *inode, bool update);
+void cifs_fscache_get_inode_cookie(struct inode *inode);
+void cifs_fscache_release_inode_cookie(struct inode *inode);
+void cifs_fscache_unuse_inode_cookie(struct inode *inode, bool update);
 
 static inline
 void cifs_fscache_fill_coherency(struct inode *inode,

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-09-07 21:36 UTC #2 lore raw

PATCH 2/4 cifs: SMB1 split: Create smb1proto.h for SMB1 declarations

From: David Howells <[email protected]>

[ Upstream commit 86c666506ea2c42649879eeac7f29e7bedef2f23 ]

Signed-off-by David Howells <[email protected]>

cc Steve French <[email protected]>

cc Paulo Alcantara <[email protected]>

cc Enzo Matsumiya <[email protected]>

cc [email protected]

Acked-by Enzo Matsumiya <[email protected]>

Signed-off-by Steve French <[email protected]>

Stable-dep-of: 65deb1835934 ("smb: client: reject a tree connect response whose byte count is too small")

Signed-off-by Sasha Levin <[email protected]>

---
 fs/smb/client/cifsglob.h  |  2 --
 fs/smb/client/cifsproto.h | 11 +----------
 fs/smb/client/smb1proto.h | 38 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 39 insertions(+), 12 deletions(-)
 create mode 100644 fs/smb/client/smb1proto.h

fs/smb/client/cifsglob.h +0 -2

index a4e0618c58efc..6c4f31fec2141 100644
@@ -2098,8 +2098,6 @@ extern mempool_t *cifs_mid_poolp;
 
 /* Operations for different SMB versions */
 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
-extern struct smb_version_operations smb1_operations;
-extern struct smb_version_values smb1_values;
 extern struct smb_version_operations smb20_operations;
 extern struct smb_version_values smb20_values;
 #endif /* CIFS_ALLOW_INSECURE_LEGACY */

fs/smb/client/cifsproto.h +1 ~~-10~~

index 1f37bc2923fb8..c7f8650cf2498 100644
@@ -13,6 +13,7 @@
 #ifdef CONFIG_CIFS_DFS_UPCALL
 #include "dfs_cache.h"
 #endif
+#include "smb1proto.h"
 
 struct statfs;
 struct smb_rqst;

@@ -423,16 +424,6 @@ extern int CIFSSMBSetFileSize(const unsigned int xid, struct cifs_tcon *tcon,
 			      struct cifsFileInfo *cfile, __u64 size,
 			      bool set_allocation);
 
-struct cifs_unix_set_info_args {
-	__u64	ctime;
-	__u64	atime;
-	__u64	mtime;
-	__u64	mode;
-	kuid_t	uid;
-	kgid_t	gid;
-	dev_t	device;
-};
-
 extern int CIFSSMBUnixSetFileInfo(const unsigned int xid,
 				  struct cifs_tcon *tcon,
 				  const struct cifs_unix_set_info_args *args,

fs/smb/client/smb1proto.h new file +38 -0

new file mode 100644
index 0000000000000..a73213f6a2aa1
@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: LGPL-2.1 */
+/*
+ *
+ *   Copyright (c) International Business Machines  Corp., 2002,2008
+ *   Author(s): Steve French ([email protected])
+ *
+ */
+#ifndef _SMB1PROTO_H
+#define _SMB1PROTO_H
+
+struct cifs_unix_set_info_args {
+	__u64	ctime;
+	__u64	atime;
+	__u64	mtime;
+	__u64	mode;
+	kuid_t	uid;
+	kgid_t	gid;
+	dev_t	device;
+};
+
+#ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
+
+/*
+ * cifssmb.c
+ */
+
+/*
+ * smb1ops.c
+ */
+extern struct smb_version_operations smb1_operations;
+extern struct smb_version_values smb1_values;
+
+/*
+ * smb1transport.c
+ */
+
+#endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
+#endif /* _SMB1PROTO_H */

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-09-07 21:36 UTC #3 lore raw

PATCH 3/4 cifs: SMB1 split: connect.c

In reply to Sasha Levin

From: David Howells <[email protected]>

[ Upstream commit 88f7d7e32d9e086ba87c6b04a9ba57f3f41268bd ]

Split SMB1-specific connection management stuff to smb1ops.c and move CIFSTCon() to cifssmb.c.

Signed-off-by David Howells <[email protected]>

cc Steve French <[email protected]>

cc Paulo Alcantara <[email protected]>

cc Enzo Matsumiya <[email protected]>

cc [email protected]

Acked-by Enzo Matsumiya <[email protected]>

Signed-off-by Steve French <[email protected]>

Stable-dep-of: 65deb1835934 ("smb: client: reject a tree connect response whose byte count is too small")

Signed-off-by Sasha Levin <[email protected]>

---
 fs/smb/client/cifsproto.h |  13 +-
 fs/smb/client/cifssmb.c   | 140 +++++++++++++++++++++
 fs/smb/client/connect.c   | 251 --------------------------------------
 fs/smb/client/smb1ops.c   | 107 ++++++++++++++++
 fs/smb/client/smb1proto.h |   5 +
 fs/smb/client/trace.h     |  36 +++++-
 6 files changed, 293 insertions(+), 259 deletions(-)

fs/smb/client/cifsproto.h +6 -7

index c7f8650cf2498..4cab0c9524f2a 100644
@@ -338,10 +338,6 @@ extern int CIFSSMBNegotiate(const unsigned int xid,
 			    struct cifs_ses *ses,
 			    struct TCP_Server_Info *server);
 
-extern int CIFSTCon(const unsigned int xid, struct cifs_ses *ses,
-		    const char *tree, struct cifs_tcon *tcon,
-		    const struct nls_table *);
-
 extern int CIFSFindFirst(const unsigned int xid, struct cifs_tcon *tcon,
 		const char *searchName, struct cifs_sb_info *cifs_sb,
 		__u16 *searchHandle, __u16 search_flags,

@@ -384,9 +380,6 @@ extern int parse_dfs_referrals(struct get_dfs_referral_rsp *rsp, u32 rsp_size,
 			       struct dfs_info3_param **target_nodes,
 			       const struct nls_table *nls_codepage, int remap,
 			       const char *searchName, bool is_unicode);
-extern void reset_cifs_unix_caps(unsigned int xid, struct cifs_tcon *tcon,
-				 struct cifs_sb_info *cifs_sb,
-				 struct smb3_fs_context *ctx);
 extern int CIFSSMBQFSInfo(const unsigned int xid, struct cifs_tcon *tcon,
 			struct kstatfs *FSData);
 extern int SMBOldQFSInfo(const unsigned int xid, struct cifs_tcon *tcon,

@@ -775,4 +768,10 @@ static inline void cifs_free_open_info(struct cifs_open_info_data *data)
 	memset(data, 0, sizeof(*data));
 }
 
+#define smb_EIO2(_trace, _info, _info2) \
+({ \
+	trace_smb3_eio((_trace), (_info), (_info2)); \
+	-EIO; \
+})
+
 #endif			/* _CIFSPROTO_H */

fs/smb/client/cifssmb.c +140 -0

146 lines not on this page · raw message

fs/smb/client/connect.c +0 ~~-251~~

263 lines not on this page · raw message

fs/smb/client/smb1ops.c +107 -0

113 lines not on this page · raw message

fs/smb/client/smb1proto.h +5 -0

index a73213f6a2aa1..574910b5b4c8b 100644
@@ -23,12 +23,17 @@ struct cifs_unix_set_info_args {
 /*
  * cifssmb.c
  */
+int CIFSTCon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
+	     struct cifs_tcon *tcon, const struct nls_table *nls_codepage);
 
 /*
  * smb1ops.c
  */
 extern struct smb_version_operations smb1_operations;
 extern struct smb_version_values smb1_values;
+void reset_cifs_unix_caps(unsigned int xid, struct cifs_tcon *tcon,
+			  struct cifs_sb_info *cifs_sb,
+			  struct smb3_fs_context *ctx);
 
 /*
  * smb1transport.c

fs/smb/client/trace.h +35 -1

index 036c7966e2600..ebcc2913a879f 100644
@@ -20,6 +20,18 @@
 /*
  * Specify enums for tracing information.
  */
+#define smb_eio_traces \
+	EM(smb_eio_trace_sym_slash,			"sym_slash") \
+	EM(smb_eio_trace_sym_target_len,		"sym_target_len") \
+	EM(smb_eio_trace_symlink_file_size,		"symlink_file_size") \
+	EM(smb_eio_trace_tdis_in_reconnect,		"tdis_in_reconnect") \
+	EM(smb_eio_trace_tx_chained_async,		"tx_chained_async") \
+	EM(smb_eio_trace_tx_compress_failed,		"tx_compress_failed") \
+	E_(smb_eio_trace_tx_copy_iter_to_buf,		"tx_copy_iter_to_buf")
+
+#define smb3_rw_credits_traces \
+	E_(cifs_trace_rw_credits_call_readv_adjust,	"rd-call-adj")
+
 #define smb3_tcon_ref_traces					      \
 	EM(netfs_trace_tcon_ref_dec_dfs_refer,		"DEC DfsRef") \
 	EM(netfs_trace_tcon_ref_free,			"FRE       ") \

@@ -67,7 +79,9 @@
 #define EM(a, b) a,
 #define E_(a, b) a
 
-enum smb3_tcon_ref_trace { smb3_tcon_ref_traces } __mode(byte);
+enum smb_eio_trace		{ smb_eio_traces } __mode(byte);
+enum smb3_rw_credits_trace	{ smb3_rw_credits_traces } __mode(byte);
+enum smb3_tcon_ref_trace	{ smb3_tcon_ref_traces } __mode(byte);
 
 #undef EM
 #undef E_

@@ -79,6 +93,8 @@ enum smb3_tcon_ref_trace { smb3_tcon_ref_traces } __mode(byte);
 #define EM(a, b) TRACE_DEFINE_ENUM(a);
 #define E_(a, b) TRACE_DEFINE_ENUM(a);
 
+smb_eio_traces;
+smb3_rw_credits_traces;
 smb3_tcon_ref_traces;
 
 #undef EM

@@ -1218,6 +1234,24 @@ TRACE_EVENT(smb3_tcon_ref,
 		      __entry->ref)
 	    );
 
+TRACE_EVENT(smb3_eio,
+	    TP_PROTO(enum smb_eio_trace trace, unsigned long info, unsigned long info2),
+	    TP_ARGS(trace, info, info2),
+	    TP_STRUCT__entry(
+		    __field(enum smb_eio_trace,	trace)
+		    __field(unsigned long,	info)
+		    __field(unsigned long,	info2)
+			     ),
+	    TP_fast_assign(
+		    __entry->trace	= trace;
+		    __entry->info	= info;
+		    __entry->info2	= info2;
+			   ),
+	    TP_printk("%s info=%lx,%lx",
+		      __print_symbolic(__entry->trace, smb_eio_traces),
+		      __entry->info, __entry->info2)
+	    );
+
 
 #undef EM
 #undef E_

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-09-07 21:36 UTC #4 lore raw

PATCH 4/4 smb: client: reject a tree connect response whose byte count is too small

In reply to Sasha Levin

From: Bryam Vargas <[email protected]>

[ Upstream commit 65deb18359341141d37dc86fc7853511be3c87a7 ]

Fixes cc20c031bb06 ("cifs: convert CIFSTCon to use new unicode helper functions")

Cc [email protected]

Signed-off-by Bryam Vargas <[email protected]>

Reviewed-by Namjae Jeon <[email protected]>

Signed-off-by Paulo Alcantara <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 fs/smb/client/cifssmb.c | 6 ++++++
 fs/smb/client/trace.h   | 3 ++-
 2 files changed, 8 insertions(+), 1 deletion(-)

fs/smb/client/cifssmb.c +6 -0

index 4e3598543aef0..cb4d8f6258837 100644
@@ -588,6 +588,11 @@ CIFSTCon(const unsigned int xid, struct cifs_ses *ses,
 		tcon->tid = smb_buffer_response->Tid;
 		bcc_ptr = pByteArea(smb_buffer_response);
 		bytes_left = get_bcc(smb_buffer_response);
+		if (bytes_left < 2) {
+			rc = smb_EIO2(smb_eio_trace_tcon_bcc_too_small,
+				      bytes_left, 2);
+			goto out;
+		}
 		length = strnlen(bcc_ptr, bytes_left - 2);
 		if (smb_buffer->Flags2 & SMBFLG2_UNICODE)
 			is_unicode = true;

@@ -643,6 +648,7 @@ CIFSTCon(const unsigned int xid, struct cifs_ses *ses,
 			reset_cifs_unix_caps(xid, tcon, NULL, NULL);
 		}
 	}
+out:
 	cifs_buf_release(smb_buffer);
 	return rc;
 }

fs/smb/client/trace.h +2 -1

index ebcc2913a879f..688bccf20ebf0 100644
@@ -24,6 +24,7 @@
 	EM(smb_eio_trace_sym_slash,			"sym_slash") \
 	EM(smb_eio_trace_sym_target_len,		"sym_target_len") \
 	EM(smb_eio_trace_symlink_file_size,		"symlink_file_size") \
+	EM(smb_eio_trace_tcon_bcc_too_small,		"tcon_bcc_too_small") \
 	EM(smb_eio_trace_tdis_in_reconnect,		"tdis_in_reconnect") \
 	EM(smb_eio_trace_tx_chained_async,		"tx_chained_async") \
 	EM(smb_eio_trace_tx_compress_failed,		"tx_compress_failed") \

@@ -79,7 +80,7 @@
 #define EM(a, b) a,
 #define E_(a, b) a
 
-enum smb_eio_trace		{ smb_eio_traces } __mode(byte);
+enum smb_eio_trace		{ smb_eio_traces };
 enum smb3_rw_credits_trace	{ smb3_rw_credits_traces } __mode(byte);
 enum smb3_tcon_ref_trace	{ smb3_tcon_ref_traces } __mode(byte);

Signature · 1 line

2.53.0