linux-kernel - Commit f980d055a0f858d73d9467bb0b570721bbfcdfb8 causes a regression

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <a8b2287b-c459-2169-fbf4-31f3065e0897@canonical.com>
Date:   Mon, 29 Nov 2021 08:35:29 -0700
From:   Tim Gardner <tim.gardner@...onical.com>
To:     len.baker@....com
Cc:     pc@....nz, jlayton@...nel.org, stfrench@...rosoft.com,
        Kamal Mostafa <Kamal.Mostafa@...onical.com>,
        linux-cifs@...r.kernel.org,
        samba-technical <samba-technical@...ts.samba.org>,
        LKML <linux-kernel@...r.kernel.org>, stable@...r.kernel.org
Subject: Commit f980d055a0f858d73d9467bb0b570721bbfcdfb8 causes a regression

Hi Len,

I have a report (https://bugs.launchpad.net/bugs/1952094) that commit 
f980d055a0f858d73d9467bb0b570721bbfcdfb8 ("CIFS: Fix a potencially 
linear read overflow") causes a regression as a stable backport in a 5.4 
based kernel. I don't know if this regression exists in tip as well, or 
if it is unique to the backported environment. I suspect, given the 
content of the patch, that it is generic. As such, it has been 
backported to a number of stable releases:

linux-4.4.y.txt:0955df2d9bf4857e3e2287e3028903e6cec06c30
linux-4.9.y.txt:8878af780747f498551b7d360cae61b415798f18
linux-4.14.y.txt:20967547ffc6039f17c63a1c24eb779ee166b245
linux-4.19.y.txt:bea655491daf39f1934a71bf576bf3499092d3a4
linux-5.4.y.txt:b444064a0e0ef64491b8739a9ae05a952b5f8974
linux-5.10.y.txt:6c4857203ffa36918136756a889b12c5864bc4ad
linux-5.13.y.txt:9bffe470e9b537075345406512df01ca2188b725
linux-5.14.y.txt:c41dd61c86482ab34f6f039b13296308018fd99b

Could this be an off-by-one issue if the source string is full length ?

rtg
-- 
-----------
Tim Gardner
Canonical, Inc