tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ksmbd: add free_transport ops in ksmbd connection

Browse Source 
[ Upstream commit a89f5fae998bdc4d0505306f93844c9ae059d50c ]

free_transport function for tcp connection can be called from smbdirect.
It will cause kernel oops. This patch add free_transport ops in ksmbd
connection, and add each free_transports for tcp and smbdirect.

Fixes: 21a4e47578d4 ("ksmbd: fix use-after-free in __smb2_lease_break_noti()")
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Namjae Jeon
2025-06-10 18:52:56 +09:00
committed by Greg Kroah-Hartman
parent 8873080b88
commit 3890da762a
4 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/smb/server/connection.c
+1 -1
View File
@@ -40,7 +40,7 @@ void ksmbd_conn_free(struct ksmbd_conn *conn)
kvfree(conn->request_buf); kvfree(conn->request_buf);
kfree(conn->preauth_info); kfree(conn->preauth_info);
if (atomic_dec_and_test(&conn->refcnt)) { if (atomic_dec_and_test(&conn->refcnt)) {
ksmbd_free_transport(conn->transport); conn->transport->ops->free_transport(conn->transport);
kfree(conn); kfree(conn);
} }
} }
fs/smb/server/connection.h
+1
View File
@@ -132,6 +132,7 @@ struct ksmbd_transport_ops {
void *buf, unsigned int len, void *buf, unsigned int len,
struct smb2_buffer_desc_v1 *desc, struct smb2_buffer_desc_v1 *desc,
unsigned int desc_len); unsigned int desc_len);
void (*free_transport)(struct ksmbd_transport *kt);
}; };
struct ksmbd_transport { struct ksmbd_transport {
fs/smb/server/transport_rdma.c
+8 -2
View File
@@ -158,7 +158,8 @@ struct smb_direct_transport {
}; };
#define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport)) #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
#define SMBD_TRANS(t) ((struct smb_direct_transport *)container_of(t, \
struct smb_direct_transport, transport))
enum { enum {
SMB_DIRECT_MSG_NEGOTIATE_REQ = 0, SMB_DIRECT_MSG_NEGOTIATE_REQ = 0,
SMB_DIRECT_MSG_DATA_TRANSFER SMB_DIRECT_MSG_DATA_TRANSFER
@@ -409,6 +410,11 @@ err:
return NULL; return NULL;
} }
static void smb_direct_free_transport(struct ksmbd_transport *kt)
{
kfree(SMBD_TRANS(kt));
}
static void free_transport(struct smb_direct_transport *t) static void free_transport(struct smb_direct_transport *t)
{ {
struct smb_direct_recvmsg *recvmsg; struct smb_direct_recvmsg *recvmsg;
@@ -454,7 +460,6 @@ static void free_transport(struct smb_direct_transport *t)
smb_direct_destroy_pools(t); smb_direct_destroy_pools(t);
ksmbd_conn_free(KSMBD_TRANS(t)->conn); ksmbd_conn_free(KSMBD_TRANS(t)->conn);
kfree(t);
} }
static struct smb_direct_sendmsg static struct smb_direct_sendmsg
@@ -2300,4 +2305,5 @@ static const struct ksmbd_transport_ops ksmbd_smb_direct_transport_ops = {
.read = smb_direct_read, .read = smb_direct_read,
.rdma_read = smb_direct_rdma_read, .rdma_read = smb_direct_rdma_read,
.rdma_write = smb_direct_rdma_write, .rdma_write = smb_direct_rdma_write,
.free_transport = smb_direct_free_transport,
}; };
fs/smb/server/transport_tcp.c
+2 -1
View File
@@ -93,7 +93,7 @@ static struct tcp_transport *alloc_transport(struct socket *client_sk)
return t; return t;
} }
void ksmbd_free_transport(struct ksmbd_transport *kt) static void ksmbd_tcp_free_transport(struct ksmbd_transport *kt)
{ {
struct tcp_transport *t = TCP_TRANS(kt); struct tcp_transport *t = TCP_TRANS(kt);
@@ -656,4 +656,5 @@ static const struct ksmbd_transport_ops ksmbd_tcp_transport_ops = {
.read = ksmbd_tcp_read, .read = ksmbd_tcp_read,
.writev = ksmbd_tcp_writev, .writev = ksmbd_tcp_writev,
.disconnect = ksmbd_tcp_disconnect, .disconnect = ksmbd_tcp_disconnect,
.free_transport = ksmbd_tcp_free_transport,
}; };