)]}'
{
  "commit": "3265654063acb9af7a134735e634af0a1bbabb93",
  "tree": "ee04297e555beac2bbd03e9dc5fc09f4a38e31d7",
  "parents": [
    "2ad727f9fd8de8fd3803a775cb54188e63b975e4"
  ],
  "author": {
    "name": "Paulo Alcantara",
    "email": "pc@manguebit.com",
    "time": "Mon Dec 11 10:26:41 2023 -0300"
  },
  "committer": {
    "name": "He Gao",
    "email": "hegao@google.com",
    "time": "Wed Mar 20 16:22:38 2024 +0000"
  },
  "message": "smb: client: fix potential OOBs in smb2_parse_contexts()\n\ncommit af1689a9b7701d9907dfc84d2a4b57c4bc907144 upstream.\n\nValidate offsets and lengths before dereferencing create contexts in\nsmb2_parse_contexts().\n\nThis fixes following oops when accessing invalid create contexts from\nserver:\n\n  BUG: unable to handle page fault for address: ffff8881178d8cc3\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 4a01067 P4D 4a01067 PUD 0\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n  RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs]\n  Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00\n  00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 \u003c0f\u003e b7\n  7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00\n  RSP: 0018:ffffc900007939e0 EFLAGS: 00010216\n  RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90\n  RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000\n  RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000\n  R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000\n  R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22\n  FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000)\n  knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0\n  PKRU: 55555554\n  Call Trace:\n   \u003cTASK\u003e\n   ? __die+0x23/0x70\n   ? page_fault_oops+0x181/0x480\n   ? search_module_extables+0x19/0x60\n   ? srso_alias_return_thunk+0x5/0xfbef5\n   ? exc_page_fault+0x1b6/0x1c0\n   ? asm_exc_page_fault+0x26/0x30\n   ? smb2_parse_contexts+0xa0/0x3a0 [cifs]\n   SMB2_open+0x38d/0x5f0 [cifs]\n   ? smb2_is_path_accessible+0x138/0x260 [cifs]\n   smb2_is_path_accessible+0x138/0x260 [cifs]\n   cifs_is_path_remote+0x8d/0x230 [cifs]\n   cifs_mount+0x7e/0x350 [cifs]\n   cifs_smb3_do_mount+0x128/0x780 [cifs]\n   smb3_get_tree+0xd9/0x290 [cifs]\n   vfs_get_tree+0x2c/0x100\n   ? capable+0x37/0x70\n   path_mount+0x2d7/0xb80\n   ? srso_alias_return_thunk+0x5/0xfbef5\n   ? _raw_spin_unlock_irqrestore+0x44/0x60\n   __x64_sys_mount+0x11a/0x150\n   do_syscall_64+0x47/0xf0\n   entry_SYSCALL_64_after_hwframe+0x6f/0x77\n  RIP: 0033:0x7f8737657b1e\n\nBUG\u003db/329956826\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2023-52434 in the Linux kernel.\n\nReported-by: Robert Morris \u003crtm@csail.mit.edu\u003e\nCc: stable@vger.kernel.org\nChange-Id: Ic5bd7832644d20e0bb9cbb5ec7946ecec4490791\nSigned-off-by: Paulo Alcantara (SUSE) \u003cpc@manguebit.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\n[Guru: Modified the patch to be applicable to the cached_dir.c file.]\nSigned-off-by: Guruswamy Basavaiah \u003cguruswamy.basavaiah@broadcom.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/67290\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Oleksandr Tymoshenko \u003covt@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5a132c1e6f6c4def3b4d80f3d10cfd8e00ce4511",
      "old_mode": 33188,
      "old_path": "fs/smb/client/cached_dir.c",
      "new_id": "6f4d7aa70e5a236147587c71f54286c5c8e00123",
      "new_mode": 33188,
      "new_path": "fs/smb/client/cached_dir.c"
    },
    {
      "type": "modify",
      "old_id": "e65f998ea4cfc78c46b3a0021045e199ffee60c6",
      "old_mode": 33188,
      "old_path": "fs/smb/client/smb2pdu.c",
      "new_id": "d610862ac6a0592c09197d4fc1b1dd4d0208dff7",
      "new_mode": 33188,
      "new_path": "fs/smb/client/smb2pdu.c"
    },
    {
      "type": "modify",
      "old_id": "be21b5d26f67efa9f4f3130d9f94efb542b4629f",
      "old_mode": 33188,
      "old_path": "fs/smb/client/smb2proto.h",
      "new_id": "b325fde010adc102e89ff07b86e4c24281e30d79",
      "new_mode": 33188,
      "new_path": "fs/smb/client/smb2proto.h"
    }
  ]
}