This is a note to let you know that I've just added the patch titled cifs: fix out-of-bound memory access when calling smb3_notify() at mount point to the 5.11-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: cifs-fix-out-of-bound-memory-access-when-calling-smb3_notify-at-mount-point.patch and it can be found in the queue-5.11 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From a637f4ae037e1e0604ac008564934d63261a8fd1 Mon Sep 17 00:00:00 2001 From: Eugene Korenevsky <ekorenevsky@xxxxxxxxxxxxx> Date: Fri, 16 Apr 2021 10:35:30 +0300 Subject: cifs: fix out-of-bound memory access when calling smb3_notify() at mount point From: Eugene Korenevsky <ekorenevsky@xxxxxxxxxxxxx> commit a637f4ae037e1e0604ac008564934d63261a8fd1 upstream. If smb3_notify() is called at mount point of CIFS, build_path_from_dentry() returns the pointer to kmalloc-ed memory with terminating zero (this is empty FileName to be passed to SMB2 CREATE request). This pointer is assigned to the `path` variable. Then `path + 1` (to skip first backslash symbol) is passed to cifs_convert_path_to_utf16(). This is incorrect for empty path and causes out-of-bound memory access. Get rid of this "increase by one". cifs_convert_path_to_utf16() already contains the check for leading backslash in the path. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=212693 CC: <stable@xxxxxxxxxxxxxxx> # v5.6+ Signed-off-by: Eugene Korenevsky <ekorenevsky@xxxxxxxxxxxxx> Signed-off-by: Steve French <stfrench@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/cifs/smb2ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -2201,7 +2201,7 @@ smb3_notify(const unsigned int xid, stru cifs_sb = CIFS_SB(inode->i_sb); - utf16_path = cifs_convert_path_to_utf16(path + 1, cifs_sb); + utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); if (utf16_path == NULL) { rc = -ENOMEM; goto notify_exit; Patches currently in stable-queue which might be from ekorenevsky@xxxxxxxxxxxxx are queue-5.11/cifs-fix-out-of-bound-memory-access-when-calling-smb3_notify-at-mount-point.patch