This is a note to let you know that I've just added the patch titled smb3: must initialize two ACL struct fields to zero to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: smb3-must-initialize-two-acl-struct-fields-to-zero.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From f09bd695af3b8ab46fc24e5d6954a24104c38387 Mon Sep 17 00:00:00 2001 From: Steve French <stfrench@xxxxxxxxxxxxx> Date: Fri, 14 Oct 2022 18:50:20 -0500 Subject: smb3: must initialize two ACL struct fields to zero From: Steve French <stfrench@xxxxxxxxxxxxx> commit f09bd695af3b8ab46fc24e5d6954a24104c38387 upstream. Coverity spotted that we were not initalizing Stbz1 and Stbz2 to zero in create_sd_buf. Addresses-Coverity: 1513848 ("Uninitialized scalar variable") Cc: <stable@xxxxxxxxxxxxxxx> Reviewed-by: Paulo Alcantara (SUSE) <pc@xxxxxx> Signed-off-by: Steve French <stfrench@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/cifs/smb2pdu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -2354,7 +2354,7 @@ create_sd_buf(umode_t mode, bool set_own unsigned int acelen, acl_size, ace_count; unsigned int owner_offset = 0; unsigned int group_offset = 0; - struct smb3_acl acl; + struct smb3_acl acl = {}; *len = roundup(sizeof(struct crt_sd_ctxt) + (sizeof(struct cifs_ace) * 4), 8); @@ -2427,6 +2427,7 @@ create_sd_buf(umode_t mode, bool set_own acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */ acl.AclSize = cpu_to_le16(acl_size); acl.AceCount = cpu_to_le16(ace_count); + /* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */ memcpy(aclptr, &acl, sizeof(struct smb3_acl)); buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd); Patches currently in stable-queue which might be from stfrench@xxxxxxxxxxxxx are queue-5.15/ksmbd-fix-user-namespace-mapping.patch queue-5.15/ksmbd-fix-wrong-return-value-and-message-length-check-in-smb2_ioctl.patch queue-5.15/cifs-fix-the-error-length-of-validate_negotiate_info-message.patch queue-5.15/cifs-destage-dirty-pages-before-re-reading-them-for-cache-none.patch queue-5.15/smb3-must-initialize-two-acl-struct-fields-to-zero.patch queue-5.15/ksmbd-fix-endless-loop-when-encryption-for-response-fails.patch