This is a note to let you know that I've just added the patch titled ksmbd: use vfs_llseek instead of dereferencing NULL to the 5.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ksmbd-use-vfs_llseek-instead-of-dereferencing-null.patch and it can be found in the queue-5.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 067baa9a37b32b95fdeabccde4b0cb6a2cf95f96 Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" <Jason@xxxxxxxxx> Date: Sat, 25 Jun 2022 13:01:08 +0200 Subject: ksmbd: use vfs_llseek instead of dereferencing NULL From: Jason A. Donenfeld <Jason@xxxxxxxxx> commit 067baa9a37b32b95fdeabccde4b0cb6a2cf95f96 upstream. By not checking whether llseek is NULL, this might jump to NULL. Also, it doesn't check FMODE_LSEEK. Fix this by using vfs_llseek(), which always does the right thing. Fixes: f44158485826 ("cifsd: add file operations") Cc: stable@xxxxxxxxxxxxxxx Cc: linux-cifs@xxxxxxxxxxxxxxx Cc: Ronnie Sahlberg <lsahlber@xxxxxxxxxx> Cc: Hyunchul Lee <hyc.lee@xxxxxxxxx> Cc: Sergey Senozhatsky <sergey.senozhatsky@xxxxxxxxx> Reviewed-by: Namjae Jeon <linkinjeon@xxxxxxxxxx> Acked-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Signed-off-by: Jason A. Donenfeld <Jason@xxxxxxxxx> Signed-off-by: Steve French <stfrench@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/ksmbd/vfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/fs/ksmbd/vfs.c +++ b/fs/ksmbd/vfs.c @@ -1048,7 +1048,7 @@ int ksmbd_vfs_fqar_lseek(struct ksmbd_fi *out_count = 0; end = start + length; while (start < end && *out_count < in_count) { - extent_start = f->f_op->llseek(f, start, SEEK_DATA); + extent_start = vfs_llseek(f, start, SEEK_DATA); if (extent_start < 0) { if (extent_start != -ENXIO) ret = (int)extent_start; @@ -1058,7 +1058,7 @@ int ksmbd_vfs_fqar_lseek(struct ksmbd_fi if (extent_start >= end) break; - extent_end = f->f_op->llseek(f, extent_start, SEEK_HOLE); + extent_end = vfs_llseek(f, extent_start, SEEK_HOLE); if (extent_end < 0) { if (extent_end != -ENXIO) ret = (int)extent_end; Patches currently in stable-queue which might be from Jason@xxxxxxxxx are queue-5.18/ksmbd-use-vfs_llseek-instead-of-dereferencing-null.patch queue-5.18/s390-archrandom-simplify-back-to-earlier-design-and-initialize-earlier.patch