Namjae Jeon 815f1161d6 ksmbd: fix potential use-after-free in oplock/lease break ack ... commit 50f930db22 upstream. If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and ksmbd_fd_put could called twice. Reported-by: Ziyan Xu <research@securitygossip.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-07-17 18:37:24 +02:00
..
9p	9p: Add a migrate_folio method	2025-06-19 15:32:36 +02:00
adfs	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
affs	affs: don't write overlarge OFS data block size fields	2025-04-10 14:39:29 +02:00
afs	afs: Give an afs_server object a ref on the afs_cell object it points to	2025-03-07 18:25:29 +01:00
autofs	autofs: fix thinko in validate_dev_ioctl()	2024-10-28 13:16:56 +01:00
bcachefs	add a string-to-qstr constructor	2025-07-10 16:05:08 +02:00
befs
bfs
btrfs	btrfs: fix assertion when building free space tree	2025-07-17 18:37:22 +02:00
cachefiles	cachefiles: Parse the "secctx" immediately	2025-01-23 17:22:55 +01:00
ceph	ceph: fix possible integer overflow in ceph_zero_objects()	2025-07-06 11:01:36 +02:00
coda
configfs	configfs: Do not override creating attribute file failure in populate_attrs()	2025-06-27 11:11:12 +01:00
cramfs
crypto	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
debugfs	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
devpts
dlm	dlm: make tcp still work in multi-link env	2025-05-29 11:02:14 +02:00
ecryptfs	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
efivarfs	efivarfs: Fix error on non-existent file	2024-12-27 14:02:07 +01:00
efs	efs: fix the efs new mount api implementation	2024-12-05 14:01:10 +01:00
erofs	erofs: fix rare pcluster memory leak after unmounting	2025-07-17 18:37:23 +02:00
exfat	exfat: call bh_read in get_block only when necessary	2025-05-29 11:02:03 +02:00
exportfs
ext2	vfs-6.12.file	2024-09-16 09:14:02 +02:00
ext4	ext4: only dirty folios when data journaling regular files	2025-06-27 11:11:20 +01:00
f2fs	f2fs: zone: fix to calculate first_zoned_segno correctly	2025-07-10 16:04:59 +02:00
fat	fat: fix uninitialized variable	2024-10-17 00:28:06 -07:00
freevxfs
fuse	fuse: fix race between concurrent setattrs from multiple nodes	2025-07-06 11:01:32 +02:00
gfs2	gfs2: Don't start unnecessary transactions during log flush	2025-07-10 16:04:57 +02:00
hfs	hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key	2025-04-25 10:47:52 +02:00
hfsplus	hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key	2025-04-25 10:47:52 +02:00
hostfs	um: hostfs: avoid issues on inode number reuse by host	2025-04-10 14:39:25 +02:00
hpfs	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
hugetlbfs	mm: use aligned address in clear_gigantic_page()	2024-12-27 14:02:20 +01:00
iomap	iomap: skip unnecessary ifs_block_is_uptodate check	2025-05-02 07:59:27 +02:00
isofs	isofs: fix Y2038 and Y2156 issues in Rock Ridge TF entry	2025-06-27 11:11:34 +01:00
jbd2	jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()	2025-06-27 11:11:16 +01:00
jffs2	jffs2: check jffs2_prealloc_raw_node_refs() result in few other places	2025-06-27 11:11:37 +01:00
jfs	jfs: validate AG parameters in dbMount() to prevent crashes	2025-07-06 11:01:37 +02:00
kernfs	add a string-to-qstr constructor	2025-07-10 16:05:08 +02:00
lockd	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
minix
netfs	netfs: Fix ref leak on inserted extra subreq in write retry	2025-07-17 18:37:16 +02:00
nfs	NFSv4/flexfiles: Fix handling of NFS level errors in I/O	2025-07-10 16:05:09 +02:00
nfs_common	nfs: fix incorrect error handling in LOCALIO	2025-02-08 09:57:59 +01:00
nfsd	nfsd: use threads array as-is in netlink interface	2025-06-27 11:11:40 +01:00
nilfs2	nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()	2025-06-19 15:32:01 +02:00
nls	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
notify	fs: relax assertions on failure to encode file handles	2025-01-17 13:40:46 +01:00
ntfs3	fs/ntfs3: Add missing direct_IO in ntfs_aops_cmpr	2025-06-19 15:31:36 +02:00
ocfs2	ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery	2025-06-19 15:32:01 +02:00
omfs
openpromfs
orangefs	orangefs: Do not truncate file size	2025-05-29 11:02:28 +02:00
overlayfs	ovl: Check for NULL d_inode() in ovl_dentry_upper()	2025-07-06 11:01:36 +02:00
proc	mm: fix the inaccurate memory statistics issue for users	2025-07-17 18:37:13 +02:00
pstore	pstore: Change kmsg_bytes storage size to u32	2025-05-29 11:02:58 +02:00
qnx4
qnx6	fs/qnx6: Fix building with GCC 15	2025-01-23 17:22:55 +01:00
quota	quota: flush quota_release_work upon quota writeback	2024-12-09 10:40:55 +01:00
ramfs
reiserfs	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
romfs
smb	ksmbd: fix potential use-after-free in oplock/lease break ack	2025-07-17 18:37:24 +02:00
squashfs	Squashfs: check return result of sb_min_blocksize	2025-06-19 15:32:01 +02:00
sysfs
sysv
tests
tracefs	tracing: Fix tracefs mount options	2024-11-01 08:38:14 -04:00
ubifs	ubifs: skip dumping tnc tree when zroot is null	2025-02-08 09:58:01 +01:00
udf	udf: Make sure i_lenExtents is uptodate on inode eviction	2025-05-22 14:29:44 +02:00
ufs	ufs_rename(): fix bogus argument of folio_release_kmap()	2024-10-02 00:05:09 -04:00
unicode	Revert "unicode: Don't special case ignorable code points"	2024-12-14 20:04:13 +01:00
vboxsf	vboxsf: fix building with GCC 15	2025-03-22 12:54:15 -07:00
verity
xfs	xfs: don't assume perags are initialised when trimming AGs	2025-06-19 15:32:36 +02:00
zonefs	zonefs fixes for 6.12-rc2	2024-10-02 12:02:15 -07:00
aio.c
anon_inodes.c	fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass	2025-07-10 16:05:09 +02:00
attr.c
backing-file.c	fs: pass offset and result to backing_file end_write() callback	2024-10-16 13:17:45 +02:00
bad_inode.c
binfmt_elf_fdpic.c	Revert "fs: don't block i_writecount during exec"	2024-12-05 14:02:50 +01:00
binfmt_elf.c	binfmt_elf: Move brk for static PIE even if ASLR disabled	2025-05-22 14:29:35 +02:00
binfmt_flat.c	binfmt_flat: Fix integer overflow bug on 32 bit systems	2025-02-17 10:05:04 +01:00
binfmt_misc.c	Revert "fs: don't block i_writecount during exec"	2024-12-05 14:02:50 +01:00
binfmt_script.c
bpf_fs_kfuncs.c
buffer.c	fs/buffer: use sleeping version of __find_get_block()	2025-05-29 11:02:00 +02:00
char_dev.c
compat_binfmt_elf.c
coredump.c	coredump: hand a pidfd to the usermode coredump helper	2025-06-04 14:43:52 +02:00
d_path.c
dax.c	fsdax: dax_unshare_iter needs to copy entire blocks	2024-10-07 13:51:47 +02:00
dcache.c	vfs-6.12.misc	2024-09-16 08:35:09 +02:00
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c	eventpoll: don't decrement ep refcount while still holding the ep mutex	2025-07-17 18:37:01 +02:00
exec.c	exec: fix the racy usage of fs_struct->in_exec	2025-04-10 14:39:40 +02:00
fcntl.c	fcntl: make F_DUPFD_QUERY associative	2024-12-05 14:02:47 +01:00
fhandle.c	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
file_table.c	add a string-to-qstr constructor	2025-07-10 16:05:08 +02:00
file.c	fs: consistently deref the files table with rcu_dereference_raw()	2025-04-20 10:15:10 +02:00
filesystems.c	fs/filesystems: Fix potential unsigned integer underflow in fs_name()	2025-06-19 15:32:32 +02:00
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	fs/writeback: convert wbc_account_cgroup_owner to take a folio	2025-01-17 13:40:33 +01:00
fsopen.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
init.c
inode.c	bcachefs: do not use PF_MEMALLOC_NORECLAIM	2024-10-09 12:47:18 -07:00
internal.h
ioctl.c
Kconfig	nfs: add missing selections of CONFIG_CRC32	2025-04-25 10:47:50 +02:00
Kconfig.binfmt
kernel_read_file.c
libfs.c	libfs: Fix duplicate directory entry in offset_dir_lookup	2025-03-28 22:03:28 +01:00
locks.c	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
Makefile
mbcache.c
mnt_idmapping.c	fuse update for 6.12	2024-09-24 15:29:42 -07:00
mount.h	fs: kill MNT_ONRB	2025-01-17 13:40:50 +01:00
mpage.c	fs/writeback: convert wbc_account_cgroup_owner to take a folio	2025-01-17 13:40:33 +01:00
namei.c	fuse: don't truncate cached, mutated symlink	2025-03-22 12:54:20 -07:00
namespace.c	attach_recursive_mnt(): do not lock the covering tree when sliding something under it	2025-07-06 11:01:39 +02:00
nsfs.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
open.c	openat2: explicitly return -E2BIG for (usize > PAGE_SIZE)	2024-10-10 12:09:03 +02:00
pidfs.c	pidfs: improve multi-threaded exec and premature thread-group leader exit polling	2025-05-29 11:02:09 +02:00
pipe.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
pnode.c
pnode.h
posix_acl.c	fs: Use in_group_or_capable() helper to simplify the code	2024-08-30 08:22:37 +02:00
proc_namespace.c
read_write.c	fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid()	2024-12-05 14:01:11 +01:00
readdir.c
remap_range.c
select.c	select: Fix unbalanced user_access_end()	2025-02-08 09:56:53 +01:00
seq_file.c
signalfd.c	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
splice.c	splice: remove duplicate noinline from pipe_clear_nowait	2025-05-02 07:59:04 +02:00
stack.c
stat.c
statfs.c
super.c	fs/super.c: introduce get_tree_bdev_flags()	2024-10-21 14:30:26 +02:00
sync.c
sysctls.c
timerfd.c
userfaultfd.c	mm/userfaultfd: fix uninitialized output field for -EAGAIN race	2025-05-18 08:24:52 +02:00
utimes.c
xattr.c	fs/xattr.c: fix simple_xattr_list()	2025-06-27 11:11:36 +01:00