)]}'
{
  "commit": "b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc",
  "tree": "702c02e0fecc22e9ef800176a2ceb191c1584e8a",
  "parents": [
    "eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb"
  ],
  "author": {
    "name": "Frank Sorenson",
    "email": "sorenson@redhat.com",
    "time": "Wed Sep 16 16:33:58 2026 -0500"
  },
  "committer": {
    "name": "Paulo Alcantara",
    "email": "pc@manguebit.org",
    "time": "Thu Sep 17 15:04:12 2026 -0300"
  },
  "message": "smb: client: fix missing iov bounds check in parse_posix_sids()\n\nIn parse_posix_sids(), sidsbuf_end is calculated using the server-supplied\nout_len without being validated against the actual length of the received\niov (iov_len).\n\nIf a server provides an inflated out_len, sidsbuf_end will point past the\nend of the iov. This defeats the bounds guards in posix_info_sid_size(),\nallowing out-of-bounds reads into adjacent kernel memory.\n\nFix this by rejecting responses where the calculated sidsbuf_end would\nexceed the received iov boundaries or cause pointer wraparound.\n\nFixes: a90f37e3d7ac (\"smb: client: parse owner/group when creating reparse points\")\nCc: stable@vger.kernel.org\nSigned-off-by: Frank Sorenson \u003csorenson@redhat.com\u003e\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "96063e355186509697e6061db8793b0301644fec",
      "old_mode": 33188,
      "old_path": "fs/smb/client/smb2inode.c",
      "new_id": "13fe8e3b48f3192cde56798a0a66e30908395abf",
      "new_mode": 33188,
      "new_path": "fs/smb/client/smb2inode.c"
    }
  ]
}