To be clear here we have already tested 5.10.206 and 5.15.146 with the proposed fix and we no longer see the reported CIFS mounting failure. Hazem On 15/01/2024, 14:23, "Mohamed Abuelfotoh, Hazem" <abuehaze@xxxxxxxxxx <mailto:abuehaze@xxxxxxxxxx>> wrote: It looks like both 5.15.146 and 5.10.206 are impacted by this regression as they both have the bad commit 33eae65c6f (smb: client: fix OOB in SMB2_query_info_init()). We tried to apply the proposed fix eb3e28c1e89b ("smb3: Replace smb2pdu 1-element arrays with flex-arrays”) but there are a lot of dependencies required to do the backport. Is it possible to consider the simple fix that Paulo proposed as a solution for 5.10 and 5.15. We were lucky with 5.4 as it doesn’t have the bad commit because of merge conflict reported in https://lore.kernel.org/all/2023122857-doubling-crazed-27f4@gregkh/T/#m3aa009c332999268f71361237ace6ded9110f0d0 <https://lore.kernel.org/all/2023122857-doubling-crazed-27f4@gregkh/T/#m3aa009c332999268f71361237ace6ded9110f0d0> diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 05ff8a457a3d..aed5067661de 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -3556,7 +3556,7 @@ SMB2_query_info_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, iov[0].iov_base = (char *)req; /* 1 for Buffer */ - iov[0].iov_len = len; + iov[0].iov_len = len - 1; return 0; } Hazem
