Commit a89f5fae authored by Namjae Jeon's avatar Namjae Jeon Committed by Steve French
Browse files

ksmbd: add free_transport ops in ksmbd connection 



free_transport function for tcp connection can be called from smbdirect.
It will cause kernel oops. This patch add free_transport ops in ksmbd
connection, and add each free_transports for tcp and smbdirect.

Fixes: 21a4e475 ("ksmbd: fix use-after-free in __smb2_lease_break_noti()")
Reviewed-by: default avatarStefan Metzmacher <metze@samba.org>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent e04c78d8

fs/smb/server/connection.c

+1 −1
Original line number Diff line number Diff line
@@ -40,7 +40,7 @@ void ksmbd_conn_free(struct ksmbd_conn *conn) 
	kvfree(conn->request_buf);

	kfree(conn->preauth_info);

	if (atomic_dec_and_test(&conn->refcnt)) {

		ksmbd_free_transport(conn->transport);

		conn->transport->ops->free_transport(conn->transport);

		kfree(conn);

	}

}

fs/smb/server/connection.h

+1 −0
Original line number Diff line number Diff line
@@ -133,6 +133,7 @@ struct ksmbd_transport_ops { 
			  void *buf, unsigned int len,

			  struct smb2_buffer_desc_v1 *desc,

			  unsigned int desc_len);

	void (*free_transport)(struct ksmbd_transport *kt);

};



struct ksmbd_transport {

fs/smb/server/transport_rdma.c

+8 −2
Original line number Diff line number Diff line
@@ -159,7 +159,8 @@ struct smb_direct_transport { 
};



#define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))



#define SMBD_TRANS(t)	((struct smb_direct_transport *)container_of(t, \

				struct smb_direct_transport, transport))

enum {

	SMB_DIRECT_MSG_NEGOTIATE_REQ = 0,

	SMB_DIRECT_MSG_DATA_TRANSFER
@@ -410,6 +411,11 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id) 
	return NULL;

}



static void smb_direct_free_transport(struct ksmbd_transport *kt)

{

	kfree(SMBD_TRANS(kt));

}



static void free_transport(struct smb_direct_transport *t)

{

	struct smb_direct_recvmsg *recvmsg;
@@ -455,7 +461,6 @@ static void free_transport(struct smb_direct_transport *t) 


	smb_direct_destroy_pools(t);

	ksmbd_conn_free(KSMBD_TRANS(t)->conn);

	kfree(t);

}



static struct smb_direct_sendmsg
@@ -2281,4 +2286,5 @@ static const struct ksmbd_transport_ops ksmbd_smb_direct_transport_ops = { 
	.read		= smb_direct_read,

	.rdma_read	= smb_direct_rdma_read,

	.rdma_write	= smb_direct_rdma_write,

	.free_transport = smb_direct_free_transport,

};

fs/smb/server/transport_tcp.c

+2 −1
Original line number Diff line number Diff line
@@ -93,7 +93,7 @@ static struct tcp_transport *alloc_transport(struct socket *client_sk) 
	return t;

}



void ksmbd_free_transport(struct ksmbd_transport *kt)

static void ksmbd_tcp_free_transport(struct ksmbd_transport *kt)

{

	struct tcp_transport *t = TCP_TRANS(kt);
@@ -656,4 +656,5 @@ static const struct ksmbd_transport_ops ksmbd_tcp_transport_ops = { 
	.read		= ksmbd_tcp_read,

	.writev		= ksmbd_tcp_writev,

	.disconnect	= ksmbd_tcp_disconnect,

	.free_transport = ksmbd_tcp_free_transport,

};