Skip to content

Commit 1322137

Browse files
author
CKI KWF Bot
committed
Merge: CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/820 JIRA: https://issues.redhat.com/browse/RHEL-87906 CVE: CVE-2025-21962 ``` commit d5a30fd Author: Murad Masimov <m.masimov@mt-integration.ru> Date: Tue Mar 11 17:22:06 2025 +0300 cifs: Fix integer overflow while processing closetimeo mount option User-provided mount parameter closetimeo of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies which can lead to an integer overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 5efdd91 ("smb3: allow deferred close timeout to be configurable") Signed-off-by: Murad Masimov <m.masimov@mt-integration.ru> Signed-off-by: Steve French <stfrench@microsoft.com>``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> --- <small>Created 2025-04-29 14:41 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://issues.redhat.com/secure/CreateIssueDetails!init.jspa?pid=12334433&issuetype=1&priority=4&summary=backporter+webhook+issue&components=kernel-workflow+/+backporter)</small> Approved-by: Paulo Alcantara <paalcant@redhat.com> Approved-by: Jay Shin <jaeshin@redhat.com> Approved-by: Benjamin Coddington <bcodding@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
2 parents bdacc43 + bc2a5df commit 1322137

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

fs/smb/client/fs_context.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1312,11 +1312,11 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
13121312
ctx->acdirmax = ctx->acregmax = HZ * result.uint_32;
13131313
break;
13141314
case Opt_closetimeo:
1315-
ctx->closetimeo = HZ * result.uint_32;
1316-
if (ctx->closetimeo > SMB3_MAX_DCLOSETIMEO) {
1315+
if (result.uint_32 > SMB3_MAX_DCLOSETIMEO / HZ) {
13171316
cifs_errorf(fc, "closetimeo too large\n");
13181317
goto cifs_parse_mount_err;
13191318
}
1319+
ctx->closetimeo = HZ * result.uint_32;
13201320
break;
13211321
case Opt_echo_interval:
13221322
ctx->echo_interval = result.uint_32;

0 commit comments

Comments
 (0)