Commit c049ee14 authored Apr 19, 2026 by DaeMyung Kang Committed by Steve French Apr 22, 2026

ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()



When per-session tree_conn_ida was converted from a dynamically
allocated ksmbd_ida to an embedded struct ida, ksmbd_ida_free() was
removed from ksmbd_session_destroy() but no matching ida_destroy()
was added.  The session is therefore freed with the IDA's backing
xarray still intact.

The kernel IDA API expects ida_init() and ida_destroy() to be paired
over an object's lifetime, so add the missing cleanup before the
enclosing session is freed.

Also move ida_init() to right after the session is allocated so that
it is always paired with the destroy call even on the early error
paths of __session_create() (ksmbd_init_file_table() or
__init_smb2_session() failures), both of which jump to the error
label and invoke ksmbd_session_destroy() on a partially initialised
session.

No leak has been observed in testing; this is a pairing fix to match
the IDA lifetime rules, not a response to a reproduced regression.

Fixes: d40012a8 ("cifsd: declare ida statically")
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

parent cc92b479

fs/smb/server/mgmt/user_session.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -391,6 +391,7 @@ void ksmbd_session_destroy(struct ksmbd_session *sess)
		free_channel_list(sess);
		kfree(sess->Preauth_HashValue);
		ksmbd_release_id(&session_ida, sess->id);
		ida_destroy(&sess->tree_conn_ida);
		kfree(sess);
		}

		@@ -665,6 +666,8 @@ static struct ksmbd_session *__session_create(int protocol)
		if (!sess)
		return NULL;

		ida_init(&sess->tree_conn_ida);

		if (ksmbd_init_file_table(&sess->file_table))
		goto error;

		@@ -684,8 +687,6 @@ static struct ksmbd_session *__session_create(int protocol)
		if (ret)
		goto error;

		ida_init(&sess->tree_conn_ida);

		down_write(&sessions_table_lock);
		hash_add(sessions_table, &sess->hlist, sess->id);
		up_write(&sessions_table_lock);