Commit 21a4e475 authored by Namjae Jeon's avatar Namjae Jeon Committed by Steve French
Browse files

ksmbd: fix use-after-free in __smb2_lease_break_noti() 



Move tcp_transport free to ksmbd_conn_free. If ksmbd connection is
referenced when ksmbd server thread terminates, It will not be freed,
but conn->tcp_transport is freed. __smb2_lease_break_noti can be performed
asynchronously when the connection is disconnected. __smb2_lease_break_noti
calls ksmbd_conn_write, which can cause use-after-free
when conn->ksmbd_transport is already freed.

Cc: stable@vger.kernel.org
Reported-by: default avatarNorbert Szetei <norbert@doyensec.com>
Tested-by: default avatarNorbert Szetei <norbert@doyensec.com>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 1df0d4c6

fs/smb/server/connection.c

+3 −1
Original line number Diff line number Diff line
@@ -39,9 +39,11 @@ void ksmbd_conn_free(struct ksmbd_conn *conn) 
	xa_destroy(&conn->sessions);

	kvfree(conn->request_buf);

	kfree(conn->preauth_info);

	if (atomic_dec_and_test(&conn->refcnt))

	if (atomic_dec_and_test(&conn->refcnt)) {

		ksmbd_free_transport(conn->transport);

		kfree(conn);

	}

}



/**

 * ksmbd_conn_alloc() - initialize a new connection instance

fs/smb/server/transport_tcp.c

+9 −5
Original line number Diff line number Diff line
@@ -93,17 +93,21 @@ static struct tcp_transport *alloc_transport(struct socket *client_sk) 
	return t;

}



static void free_transport(struct tcp_transport *t)

void ksmbd_free_transport(struct ksmbd_transport *kt)

{

	kernel_sock_shutdown(t->sock, SHUT_RDWR);

	sock_release(t->sock);

	t->sock = NULL;

	struct tcp_transport *t = TCP_TRANS(kt);



	ksmbd_conn_free(KSMBD_TRANS(t)->conn);

	sock_release(t->sock);

	kfree(t->iov);

	kfree(t);

}



static void free_transport(struct tcp_transport *t)

{

	kernel_sock_shutdown(t->sock, SHUT_RDWR);

	ksmbd_conn_free(KSMBD_TRANS(t)->conn);

}



/**

 * kvec_array_init() - initialize a IO vector segment

 * @new:	IO vector to be initialized

fs/smb/server/transport_tcp.h

+1 −0
Original line number Diff line number Diff line
@@ -8,6 +8,7 @@ 


int ksmbd_tcp_set_interfaces(char *ifc_list, int ifc_list_sz);

struct interface *ksmbd_find_netdev_name_iface_list(char *netdev_name);

void ksmbd_free_transport(struct ksmbd_transport *kt);

int ksmbd_tcp_init(void);

void ksmbd_tcp_destroy(void);