Namjae Jeon cedff600f1 ksmbd: require source read access for duplicate extents ...

FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to
vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB
access mask granted to the source handle. A handle opened with attribute
access can consequently be used to copy file contents into an
attacker-readable destination.

Require FILE_READ_DATA on the source handle before either VFS operation,
matching other ksmbd data-copy paths.

Cc: stable@vger.kernel.org
Reported-by: Musaab Khan <musaab.khan@protonmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

2026-06-16 18:57:22 -05:00

..

9p

netfs: Fix potential for tearing in ->remote_i_size and ->zero_point

2026-05-12 14:42:30 +02:00

adfs

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux

2026-04-25 07:44:26 -07:00

affs

affs: handle set_blocksize failures

2026-05-21 13:39:35 +02:00

afs

VFS: use wait_var_event for waiting in d_alloc_parallel()

2026-06-05 00:34:54 -04:00

autofs

Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 14:20:11 -07:00

befs

befs: handle set_blocksize failures

2026-05-21 13:39:35 +02:00

bfs

bfs: replace get_zeroed_page() with kzalloc()

2026-05-28 13:58:14 +02:00

btrfs

Merge tag 'vfs-7.2-rc1.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:25:36 +05:30

cachefiles

cachefiles: Fix error return when vfs_mkdir() fails

2026-05-15 15:32:43 +02:00

ceph

Merge tag 'vfs-7.2-rc1.openat2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:11:05 +05:30

coda

Merge tag 'pull-coda' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-04-21 14:03:10 -07:00

configfs

Merge tag 'pull-configfs-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-06-15 04:28:20 +05:30

cramfs

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

crypto

Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux

2026-04-13 17:29:12 -07:00

debugfs

debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str()

2026-04-02 16:15:23 +02:00

devpts

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

dlm

ipv6: convert CONFIG_IPV6 to built-in only and clean up Kconfigs

2026-03-29 11:21:22 -07:00

ecryptfs

ecryptfs: use d_splice_alias() for ->lookup() return value

2026-06-05 01:12:15 -04:00

efivarfs

efivarfs: use QSTR() in efivarfs_alloc_dentry

2026-04-28 12:30:59 +02:00

efs

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

erofs

erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()

2026-06-02 01:52:58 +08:00

exfat

exfat: Implement fileattr_get for case sensitivity

2026-05-11 16:50:28 +02:00

exportfs

find_acceptable_alias(): skip NORCU aliases with zero refcount

2026-06-05 00:34:55 -04:00

ext2

Merge tag 'fs_for_v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

2026-04-15 19:22:16 -07:00

ext4

Merge tag 'vfs-7.2-rc1.bh' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:36:08 +05:30

f2fs

Merge tag 'f2fs-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs

2026-04-21 14:50:04 -07:00

fat

fat: Implement fileattr_get for case sensitivity

2026-05-11 16:50:28 +02:00

freevxfs

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

fuse

Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-06-15 04:15:31 +05:30

gfs2

Merge tag 'pull-d_add' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-06-15 04:21:00 +05:30

hfs

hfs: Implement fileattr_get for case sensitivity

2026-05-11 16:50:28 +02:00

hfsplus

hfsplus: Report case sensitivity in fileattr_get

2026-05-11 16:50:28 +02:00

hostfs

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hpfs

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

hugetlbfs

Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"

2026-05-21 19:06:11 -07:00

iomap

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

isofs

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

jbd2

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

jffs2

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

jfs

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

kernfs

Merge tag 'driver-core-7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/driver-core/driver-core

2026-06-15 12:41:17 +05:30

lockd

Merge tag 'nfsd-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

2026-05-26 13:49:13 -07:00

minix

minix: release the sb buffer_head when setting the v3 block size fails

2026-05-22 12:20:49 +02:00

netfs

netfs, afs: Fix write skipping in dir/link writepages

2026-05-12 14:42:32 +02:00

nfs

Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-06-15 04:15:31 +05:30

nfs_common

…

nfsd

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

nilfs2

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

nls

…

notify

Merge tag 'vfs-7.2-rc1.directory.delegations' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 02:50:44 +05:30

ntfs

ntfs: use d_splice_alias() for ->lookup() return value

2026-06-06 17:12:21 -04:00

ntfs3

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

ocfs2

Merge tag 'vfs-7.2-rc1.procfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 04:07:58 +05:30

omfs

omfs: handle set_blocksize failures

2026-05-21 13:39:36 +02:00

openpromfs

…

orangefs

fs: Fix return in jfs_mkdir and orangefs_mkdir

2026-05-11 14:19:01 +02:00

overlayfs

ovl: keep err zero after successful ovl_cache_get()

2026-05-18 14:56:15 +02:00

proc

Merge tag 'timers-nohz-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

2026-06-15 13:48:52 +05:30

pstore

Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-15 12:59:16 -07:00

qnx4

qnx4: handle set_blocksize failures

2026-05-21 13:39:35 +02:00

qnx6

fs/qnx6: fix pointer arithmetic in directory iteration

2026-05-28 14:16:33 +02:00

quota

quota: allocate dquot_hash with kmalloc()

2026-05-27 15:12:22 +02:00

ramfs

folio_batch: rename pagevec.h to folio_batch.h

2026-04-05 13:53:07 -07:00

resctrl

Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-15 12:59:16 -07:00

romfs

Merge tag 'mm-stable-2026-02-18-19-48' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-02-18 20:50:32 -08:00

smb

ksmbd: require source read access for duplicate extents

2026-06-16 18:57:22 -05:00

squashfs

Squashfs: check metadata block offset is within range

2026-02-24 11:13:27 -08:00

sysfs

Merge tag 'driver-core-7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/driver-core/driver-core

2026-06-15 12:41:17 +05:30

tests

fs/tests: exec: Remove bad test vector

2026-03-18 11:41:53 -07:00

tracefs

tracefs: use d_splice_alias() in ->lookup() instances

2026-06-05 01:12:15 -04:00

ubifs

fs: add icount_read_once() and stop open-coding ->i_count loads

2026-05-11 23:12:28 +02:00

udf

Merge tag 'pull-fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/viro/vfs

2026-06-15 15:53:57 +05:30

ufs

Merge tag 'vfs-7.1-rc1.bh.metadata' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:46:42 -07:00

unicode

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vboxsf

vboxsf: Implement fileattr_get for case sensitivity

2026-05-11 16:50:29 +02:00

verity

fsverity: generate and store zero-block hash

2026-06-05 13:36:22 +02:00

xfs

Merge tag 'vfs-7.2-rc1.casefold' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 02:55:34 +05:30

zonefs

zonefs: handle integer overflow in zonefs_fname_to_fno

2026-05-12 07:53:20 +09:00

aio.c

libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers

2026-06-04 10:10:49 +02:00

anon_inodes.c

libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers

2026-06-04 10:10:49 +02:00

attr.c

filelock: add support for ignoring deleg breaks for dir change events

2026-05-15 19:24:32 +02:00

backing-file.c

backing-file: fix backing_file_open() kerneldoc parameter

2026-06-10 09:49:25 +02:00

bad_inode.c

fs: refactor ->update_time handling

2026-01-12 14:01:32 +01:00

binfmt_elf_fdpic.c

Merge tag 'vfs-7.1-rc1.kino' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 12:19:01 -07:00

binfmt_elf.c

mm: unexport vm_brk_flags() and eliminate vm_flags parameter

2026-04-05 13:53:39 -07:00

binfmt_flat.c

…

binfmt_misc.c

binfmt_misc: replace __get_free_page() with kmalloc()

2026-05-28 13:58:14 +02:00

binfmt_script.c

…

bpf_fs_kfuncs.c

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

buffer.c

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

char_dev.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

compat_binfmt_elf.c

…

coredump.c

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

d_path.c

dcache: permit dynamic_dname()s up to NAME_MAX

2026-04-07 12:32:22 +02:00

dax.c

Merge tag 'libnvdimm-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

2026-04-21 14:12:01 -07:00

dcache.c

Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-06-15 04:15:31 +05:30

direct-io.c

…

drop_caches.c

…

eventfd.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

eventpoll.c

eventpoll: restore EP_UNACTIVE_PTR sentinel for ctx->tfile_check_list

2026-06-04 13:53:50 +02:00

exec.c

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

fcntl.c

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

fhandle.c

fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()

2026-06-04 09:39:50 +02:00

file_attr.c

fs: Add case sensitivity flags to file_kattr

2026-05-11 16:50:27 +02:00

file_table.c

Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-06-15 04:15:31 +05:30

file.c

fs: retire stale comment in fget_task_next()

2026-05-28 14:27:00 +02:00

filesystems.c

fs: fix ups and tidy ups to /proc/filesystems caching

2026-06-12 14:26:27 +02:00

fs_context.c

Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 14:20:11 -07:00

fs_dirent.c

…

fs_parser.c

fs: remove fsparam_path / fs_param_is_path

2026-02-19 14:34:26 +01:00

fs_pin.c

…

fs_struct.c

fs: add <linux/init_task.h> for 'init_fs'

2026-01-14 16:50:37 +01:00

fs-writeback.c

mm: kick writeback flusher for IOCB_DONTCACHE with targeted dirty tracking

2026-06-04 10:16:51 +02:00

fserror.c

treewide: change inode->i_ino from unsigned long to u64

2026-03-06 14:31:28 +01:00

fsopen.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

init.c

Merge tag 'pull-filename' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-02-09 16:58:28 -08:00

inode.c

Merge tag 'vfs-7.2-rc1.inode' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 02:44:23 +05:30

internal.h

Merge tag 'lsm-pr-20260410' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

2026-04-13 15:17:28 -07:00

ioctl.c

…

Kconfig

ntfs: add Kconfig and Makefile

2026-02-19 21:51:00 +09:00

Kconfig.binfmt

…

kernel_read_file.c

…

libfs.c

Merge tag 'pull-d_add' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-06-15 04:21:00 +05:30

locks.c

filelock: add an inode_lease_ignore_mask helper

2026-05-15 19:24:32 +02:00

Makefile

ntfs: add Kconfig and Makefile

2026-02-19 21:51:00 +09:00

mbcache.c

Merge tag 'vfs-7.1-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-04-13 14:20:11 -07:00

mnt_idmapping.c

fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap

2026-05-11 14:19:01 +02:00

mount.h

Merge tag 'vfs-7.2-rc1.procfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 04:07:58 +05:30

mpage.c

Merge tag 'mm-stable-2026-04-13-21-45' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-04-15 12:59:16 -07:00

namei.c

Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-06-15 04:15:31 +05:30

namespace.c

Merge tag 'vfs-7.2-rc1.procfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 04:07:58 +05:30

nsfs.c

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

nullfs.c

fs: add immutable rootfs

2026-01-12 16:52:09 +01:00

open.c

openat2: new OPENAT2_REGULAR flag support

2026-05-21 15:33:47 +02:00

pidfs.c

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

pipe.c

fs/pipe: pre-allocate pages outside pipe->mutex in anon_pipe_write

2026-05-28 14:33:24 +02:00

pnode.c

…

pnode.h

…

posix_acl.c

filelock: add support for ignoring deleg breaks for dir change events

2026-05-15 19:24:32 +02:00

proc_namespace.c

…

read_write.c

fs/read_write: Do not export __kernel_write() to the entire world

2026-06-05 14:46:20 +02:00

readdir.c

fs: Replace user_access_{begin/end} by scoped user access

2026-03-24 14:44:02 +01:00

remap_range.c

…

select.c

Merge tag 'vfs-7.2-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:59:45 +05:30

seq_file.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

signalfd.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

splice.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

stack.c

…

stat.c

statx: switch to CLASS(filename_maybe_null)

2026-01-16 12:52:04 -05:00

statfs.c

user_statfs(): switch to CLASS(filename)

2026-01-16 12:52:04 -05:00

super.c

Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2026-06-15 04:15:31 +05:30

sync.c

sync_file_range: delete dead S_ISLNK code

2026-05-21 13:39:36 +02:00

sysctls.c

…

timerfd.c

fs/timerfd: Use the new alarm/hrtimer functions

2026-05-01 21:36:13 +02:00

userfaultfd.c

userfaultfd: allow registration of ranges below mmap_min_addr

2026-04-18 00:10:56 -07:00

utimes.c

do_utimes_path(): switch to CLASS(filename_uflags)

2026-01-16 12:52:03 -05:00

xattr.c

Merge tag 'vfs-7.2-rc1.xattr' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2026-06-15 03:54:54 +05:30