diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2025-04-11 15:19:46 +0900 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2025-04-14 22:21:26 -0500 |
| commit | 21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de (patch) | |
| tree | 7ba00540ed13ec8720c02e8a3ffab0f161905af8 /fs/smb/server/connection.c | |
| parent | 1df0d4c616138784e033ad337961b6e1a6bcd999 (diff) | |
| download | linux-next-21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de.tar.gz linux-next-21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de.zip | |
ksmbd: fix use-after-free in __smb2_lease_break_noti()
Move tcp_transport free to ksmbd_conn_free. If ksmbd connection is
referenced when ksmbd server thread terminates, It will not be freed,
but conn->tcp_transport is freed. __smb2_lease_break_noti can be performed
asynchronously when the connection is disconnected. __smb2_lease_break_noti
calls ksmbd_conn_write, which can cause use-after-free
when conn->ksmbd_transport is already freed.
Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei <norbert@doyensec.com>
Tested-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/smb/server/connection.c')
| -rw-r--r-- | fs/smb/server/connection.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c index c1f22c129111..83764c230e9d 100644 --- a/fs/smb/server/connection.c +++ b/fs/smb/server/connection.c @@ -39,8 +39,10 @@ void ksmbd_conn_free(struct ksmbd_conn *conn) xa_destroy(&conn->sessions); kvfree(conn->request_buf); kfree(conn->preauth_info); - if (atomic_dec_and_test(&conn->refcnt)) + if (atomic_dec_and_test(&conn->refcnt)) { + ksmbd_free_transport(conn->transport); kfree(conn); + } } /** |