Hi Greg, On Fri, Dec 13, 2024 at 03:33:31PM +0100, Greg KH wrote: > On Thu, Dec 12, 2024 at 10:48:55PM +0100, Michael Krause wrote: > > On 12/12/24 1:26 PM, Greg KH wrote: > > > On Tue, Dec 10, 2024 at 12:05:00AM +0100, Michael Krause wrote: > > > > On 12/3/24 3:45 PM, Salvatore Bonaccorso wrote: > > > > > Paulo, > > > > > > > > > > On Tue, Dec 03, 2024 at 10:18:25AM -0300, Paulo Alcantara wrote: > > > > > > Michael Krause <mk-debian@xxxxxxxx> writes: > > > > > > > > > > > > > On 11/30/24 10:21 AM, Salvatore Bonaccorso wrote: > > > > > > > > Michael, did a manual backport of 24a9799aa8ef ("smb: client: fix UAF > > > > > > > > in smb2_reconnect_server()") which seems in fact to solve the issue. > > > > > > > > > > > > > > > > Michael, can you please post your backport here for review from Paulo > > > > > > > > and Steve? > > > > > > > > > > > > > > Of course, attached. > > > > > > > > > > > > > > Now I really hope I didn't screw it up :) > > > > > > > > > > > > LGTM. Thanks Michael for the backport. > > > > > > > > > > Thanks a lot for the review. So to get it accepted it needs to be > > > > > brough into the form which Greg can pick up. Michael can you do that > > > > > and add your Signed-off line accordingly? > > > > Happy to. Hope this is in the proper format: > > > > > > It's corrupted somehow: > > > > > > patching file fs/smb/client/connect.c > > > patch: **** malformed patch at line 202: if (rc) > > > > > > > > > Can you resend it or attach it? > > > > > > thanks, > > > > > > greg k-h > > > > Ugh, how embarrassing. I'm sorry, I "fixed" some minor whitespace issue directly in the patch and apparently did something wrong. > > > > I redid the white space fix before diffing again and attach and inline the new version. The chunks are a bit alternated to the earlier version now unfortunately. This one applies.. > > Doesn't apply for me: > > checking file fs/smb/client/connect.c > Hunk #1 FAILED at 259. > Hunk #2 FAILED at 1977. > Hunk #3 FAILED at 2035. > 3 out of 3 hunks FAILED > checking file fs/smb/client/connect.c > > Any ideas? Hmm, that is strange. I just did the follwoing: $ git branch 6.1.y-backport-smb-uaf-smb2_reconnect_server v6.1.119 $ git checkout 6.1.y-backport-smb-uaf-smb2_reconnect_server $ git am /tmp/backport-6.1-smb-client-fix-UAF-in-smb2_reconnect_server.v2.patch Applying: smb: client: fix UAF in smb2_reconnect_server() .git/rebase-apply/patch:102: space before tab in indent. spin_unlock(&ses->ses_lock); warning: 1 line adds whitespace errors. The warning looks correct, there is a space before the indent here: [...] 180 +^Ido_logoff = ses->ses_status == SES_GOOD && server->ops->logoff;$ 181 +^Ises->ses_status = SES_EXITING;$ 182 +^Itcon = ses->tcon_ipc;$ 183 +^Ises->tcon_ipc = NULL;$ 184 + ^Ispin_unlock(&ses->ses_lock);$ <--- space before the indent tab 185 +^Ispin_unlock(&cifs_tcp_ses_lock);$ 186 $ 187 -^Iif (ses->ses_status == SES_EXITING && server->ops->logoff) {$ [...] Regards, Salvatore