Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges check_lock_range() uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range. The start == end shortcut therefore skips mandatory byte-range lock checks for one-byte reads, writes, copychunk operations and one-byte truncate ranges. A conflicting lock covering that byte is not checked and the operation is allowed to proceed. Remove the shortcut. The truncate size == inode->i_size case is already handled by only calling check_lock_range() when the new size differs from the current file size.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
52fcbb92e0d3acfd1448b2a43b6595d540da5295 to < a89cc145832e81c32199d4ca2e1ea8bd51ed601daffectedda29cd197246c85c0473259f1cad897d9d28faea to < 993e0158331d37c04da18efe551b5e1e35fb3078affecteda6f4cfa3783804336491e0edcb250c25f9b59d33 to < f751d6e39d4c937c45f8fedc66699aa7d2d52288affected571204e4758a528fbd67330bd4b0dfbdafb33dd8 to < 84c2d8e807ac489f5c91769293fb15dfdae8bae8affected5d510ac31626ed157d2182149559430350cf2104 to < 07a9e289ff7edcc004f58952405f8a65c4e37512affected5d510ac31626ed157d2182149559430350cf2104 to < d40c24634fe077a0dc91fd11fccf44ce12b454d5affected6.1.160 to < 6.1.188affected6.6.120 to < 6.6.157affected6.12.64 to < 6.12.110affected6.18.3 to < 6.18.52affected
Linux Linux
Default version status: affected
6.19affected0 to < 6.19unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a89cc145832e81c32199d4ca2e1ea8bd51ed601d ↗
- https://git.kernel.org/stable/c/993e0158331d37c04da18efe551b5e1e35fb3078 ↗
- https://git.kernel.org/stable/c/f751d6e39d4c937c45f8fedc66699aa7d2d52288 ↗
- https://git.kernel.org/stable/c/84c2d8e807ac489f5c91769293fb15dfdae8bae8 ↗
- https://git.kernel.org/stable/c/07a9e289ff7edcc004f58952405f8a65c4e37512 ↗
- https://git.kernel.org/stable/c/d40c24634fe077a0dc91fd11fccf44ce12b454d5 ↗