Namjae JeonandGreg Kroah-Hartman 97c3559899 ksmbd: fix potential use-after-free in oplock/lease break ack ...

commit 50f930db22 upstream.

If ksmbd_iov_pin_rsp return error, use-after-free can happen by
accessing opinfo->state and opinfo_put and ksmbd_fd_put could
called twice.

Reported-by: Ziyan Xu <research@securitygossip.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-07-17 18:35:22 +02:00

..

9p

fs/9p: fix uninitialized values during inode evict

2024-11-22 15:38:37 +01:00

adfs

…

affs

affs: don't write overlarge OFS data block size fields

2025-04-10 14:37:37 +02:00

afs

afs: Fix the server_list to unuse a displaced server rather than putting it

2025-03-07 16:45:38 +01:00

autofs

…

befs

…

bfs

…

btrfs

btrfs: fix assertion when building free space tree

2025-07-17 18:35:21 +02:00

cachefiles

cachefiles: Fix NULL pointer dereference in object->file

2025-02-17 09:40:42 +01:00

ceph

ceph: fix possible integer overflow in ceph_zero_objects()

2025-07-06 11:00:08 +02:00

coda

…

configfs

configfs: Do not override creating attribute file failure in populate_attrs()

2025-06-27 11:08:42 +01:00

cramfs

fs: Convert to bdev_open_by_dev()

2024-08-19 06:04:25 +02:00

crypto

fs: Create a generic is_dot_dotdot() utility

2024-10-04 16:29:48 +02:00

debugfs

…

devpts

…

dlm

dlm: make tcp still work in multi-link env

2025-06-04 14:41:57 +02:00

ecryptfs

fs: Create a generic is_dot_dotdot() utility

2024-10-04 16:29:48 +02:00

efivarfs

efivarfs: Fix error on non-existent file

2024-12-27 13:58:50 +01:00

efs

…

erofs

erofs: fix to add missing tracepoint in erofs_read_folio()

2025-07-17 18:35:16 +02:00

exfat

exfat: fix the infinite loop in exfat_find_last_cluster()

2025-04-10 14:37:35 +02:00

exportfs

…

ext2

ext2: Verify bitmap and itable block numbers before using them

2024-08-03 08:54:15 +02:00

ext4

ext4: only dirty folios when data journaling regular files

2025-06-27 11:08:47 +01:00

f2fs

f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault

2025-07-10 16:03:21 +02:00

fat

fat: fix uninitialized variable

2024-10-22 15:46:20 +02:00

freevxfs

…

fscache

netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING

2024-12-09 10:31:45 +01:00

fuse

fuse: fix race between concurrent setattrs from multiple nodes

2025-07-06 11:00:06 +02:00

gfs2

gfs2: move msleep to sleepable context

2025-06-27 11:08:42 +01:00

hfs

hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key

2025-04-25 10:45:47 +02:00

hfsplus

hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key

2025-04-25 10:45:47 +02:00

hostfs

um: hostfs: avoid issues on inode number reuse by host

2025-04-10 14:37:34 +02:00

hpfs

…

hugetlbfs

…

iomap

iomap: skip unnecessary ifs_block_is_uptodate check

2025-05-02 07:51:01 +02:00

isofs

isofs: Prevent the use of too small fid

2025-04-25 10:45:48 +02:00

jbd2

jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()

2025-06-27 11:08:44 +01:00

jffs2

jffs2: check jffs2_prealloc_raw_node_refs() result in few other places

2025-06-27 11:08:58 +01:00

jfs

jfs: validate AG parameters in dbMount() to prevent crashes

2025-07-06 11:00:09 +02:00

kernfs

kernfs: Relax constraint in draining guard

2025-06-19 15:28:16 +02:00

lockd

nfsd: stop setting ->pg_stats for unused stats

2024-08-19 06:04:23 +02:00

minix

…

netfs

…

nfs

NFSv4/flexfiles: Fix handling of NFS level errors in I/O

2025-07-10 16:03:18 +02:00

nfs_common

…

nfsd

nfsd: Initialize ssc before laundromat_work to prevent NULL dereference

2025-06-27 11:08:44 +01:00

nilfs2

nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()

2025-06-19 15:28:23 +02:00

nls

…

notify

fs: relax assertions on failure to encode file handles

2025-01-23 17:21:19 +01:00

ntfs

…

ntfs3

fs/ntfs3: handle hdr_first_de() return value

2025-06-19 15:28:07 +02:00

ocfs2

ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery

2025-06-19 15:28:23 +02:00

omfs

…

openpromfs

openpromfs: finish conversion to the new mount API

2024-06-12 11:11:30 +02:00

orangefs

orangefs: Do not truncate file size

2025-06-04 14:42:02 +02:00

overlayfs

ovl: Check for NULL d_inode() in ovl_dentry_upper()

2025-07-06 11:00:08 +02:00

proc

mm: fix the inaccurate memory statistics issue for users

2025-07-17 18:35:14 +02:00

pstore

pstore: Change kmsg_bytes storage size to u32

2025-06-04 14:42:11 +02:00

qnx4

…

qnx6

…

quota

quota: flush quota_release_work upon quota writeback

2024-12-09 10:33:01 +01:00

ramfs

…

reiserfs

reiserfs: fix uninit-value in comp_keys

2024-08-19 06:04:26 +02:00

romfs

fs: Convert to bdev_open_by_dev()

2024-08-19 06:04:25 +02:00

smb

ksmbd: fix potential use-after-free in oplock/lease break ack

2025-07-17 18:35:22 +02:00

squashfs

Squashfs: check return result of sb_min_blocksize

2025-06-19 15:28:23 +02:00

sysfs

fs: sysfs: Fix reference leak in sysfs_break_active_protection()

2024-04-27 17:11:41 +02:00

sysv

sysv: don't call sb_bread() with pointers_lock held

2024-04-13 13:07:34 +02:00

tracefs

eventfs: Use list_del_rcu() for SRCU protected list variable

2024-09-12 11:11:27 +02:00

ubifs

ubifs: skip dumping tnc tree when zroot is null

2025-02-08 09:52:28 +01:00

udf

udf: Make sure i_lenExtents is uptodate on inode eviction

2025-05-22 14:12:19 +02:00

ufs

…

unicode

Revert "unicode: Don't special case ignorable code points"

2024-12-14 20:00:20 +01:00

vboxsf

vboxsf: fix building with GCC 15

2025-03-22 12:50:41 -07:00

verity

fsverity: use register_sysctl_init() to avoid kmemleak warning

2024-06-16 13:47:33 +02:00

xfs

xfs: don't over-report free space or inodes in statvfs

2025-02-27 04:10:44 -08:00

zonefs

…

aio.c

…

anon_inodes.c

fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass

2025-07-10 16:03:18 +02:00

attr.c

…

bad_inode.c

…

binfmt_elf_fdpic.c

fs: binfmt_elf_efpic: don't use missing interpreter's properties

2024-08-29 17:33:33 +02:00

binfmt_elf_test.c

…

binfmt_elf.c

binfmt_elf: Move brk for static PIE even if ASLR disabled

2025-05-22 14:12:12 +02:00

binfmt_flat.c

binfmt_flat: Fix integer overflow bug on 32 bit systems

2025-02-17 09:40:16 +01:00

binfmt_misc.c

binfmt_misc: cleanup on filesystem umount

2024-08-29 17:33:27 +02:00

binfmt_script.c

…

buffer.c

buffer: make folio_create_empty_buffers() return a buffer_head

2025-02-08 09:52:26 +01:00

char_dev.c

…

compat_binfmt_elf.c

…

coredump.c

coredump: hand a pidfd to the usermode coredump helper

2025-06-04 14:42:24 +02:00

d_path.c

…

dax.c

fsdax: dax_unshare_iter needs to copy entire blocks

2024-11-08 16:28:19 +01:00

dcache.c

fs: better handle deep ancestor chains in is_subdir()

2024-07-25 09:50:54 +02:00

direct-io.c

…

drop_caches.c

…

eventfd.c

…

eventpoll.c

eventpoll: don't decrement ep refcount while still holding the ep mutex

2025-07-17 18:35:07 +02:00

exec.c

exec: fix the racy usage of fs_struct->in_exec

2025-04-10 14:37:44 +02:00

fcntl.c

fs: Fix file_set_fowner LSM hook inconsistencies

2024-10-04 16:29:56 +02:00

fhandle.c

fs: Annotate struct file_handle with __counted_by() and use struct_size()

2024-08-19 06:04:28 +02:00

file_table.c

fs: fix proc_handler for sysctl_nr_open

2025-02-08 09:51:42 +01:00

file.c

fs: consistently deref the files table with rcu_dereference_raw()

2025-04-25 10:45:10 +02:00

filesystems.c

fs/filesystems: Fix potential unsigned integer underflow in fs_name()

2025-06-19 15:28:43 +02:00

fs_context.c

…

fs_parser.c

…

fs_pin.c

…

fs_struct.c

…

fs_types.c

…

fs-writeback.c

fs/writeback: bail out if there is no more inodes for IO and queued once

2024-06-27 13:49:00 +02:00

fsopen.c

…

init.c

…

inode.c

fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name

2024-12-09 10:31:41 +01:00

internal.h

…

ioctl.c

…

Kconfig

nfs: add missing selections of CONFIG_CRC32

2025-04-25 10:45:46 +02:00

Kconfig.binfmt

…

kernel_read_file.c

…

libfs.c

libfs: Use d_children list to iterate simple_offset directories

2025-02-01 18:37:54 +01:00

locks.c

filelock: Fix fcntl/close race recovery compat path

2024-07-27 11:34:10 +02:00

Makefile

…

mbcache.c

…

mnt_idmapping.c

…

mount.h

…

mpage.c

…

namei.c

fuse: don't truncate cached, mutated symlink

2025-03-22 12:50:44 -07:00

namespace.c

attach_recursive_mnt(): do not lock the covering tree when sliding something under it

2025-07-06 11:00:11 +02:00

nsfs.c

…

open.c

openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)

2024-11-01 01:58:32 +01:00

pipe.c

…

pnode.c

…

pnode.h

…

posix_acl.c

…

proc_namespace.c

…

read_write.c

…

readdir.c

…

remap_range.c

…

select.c

hrtimer: Use and report correct timerslack values for realtime tasks

2025-03-22 12:50:37 -07:00

seq_file.c

…

signalfd.c

…

splice.c

splice: remove duplicate noinline from pipe_clear_nowait

2025-05-02 07:50:45 +02:00

stack.c

…

stat.c

…

statfs.c

…

super.c

fs: Convert to bdev_open_by_dev()

2024-08-19 06:04:25 +02:00

sync.c

…

sysctls.c

…

timerfd.c

…

userfaultfd.c

mm/userfaultfd: fix release hang over concurrent GUP

2025-04-25 10:45:31 +02:00

utimes.c

…

xattr.c

fs/xattr.c: fix simple_xattr_list()

2025-06-27 11:08:57 +01:00