diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2024-10-08 22:42:57 +0900 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2024-10-09 21:23:17 -0500 |
| commit | 7aa8804c0b67b3cb263a472d17f2cb50d7f1a930 (patch) | |
| tree | ca9bcec68d50fe0c0bb15b00308935f09737cd10 /fs/smb/server/mgmt/user_session.h | |
| parent | 8cf0b93919e13d1e8d4466eb4080a4c4d9d66d7b (diff) | |
ksmbd: fix user-after-free from session log off
There is racy issue between smb2 session log off and smb2 session setup.
It will cause user-after-free from session log off.
This add session_lock when setting SMB2_SESSION_EXPIRED and referece
count to session struct not to free session while it is being used.
Cc: stable@vger.kernel.org # v5.15+
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-25282
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/smb/server/mgmt/user_session.h')
| -rw-r--r-- | fs/smb/server/mgmt/user_session.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/smb/server/mgmt/user_session.h b/fs/smb/server/mgmt/user_session.h index dc9fded2cd43..c1c4b20bd5c6 100644 --- a/fs/smb/server/mgmt/user_session.h +++ b/fs/smb/server/mgmt/user_session.h @@ -61,6 +61,8 @@ struct ksmbd_session { struct ksmbd_file_table file_table; unsigned long last_active; rwlock_t tree_conns_lock; + + atomic_t refcnt; }; static inline int test_session_flag(struct ksmbd_session *sess, int bit) @@ -104,4 +106,6 @@ void ksmbd_release_tree_conn_id(struct ksmbd_session *sess, int id); int ksmbd_session_rpc_open(struct ksmbd_session *sess, char *rpc_name); void ksmbd_session_rpc_close(struct ksmbd_session *sess, int id); int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id); +void ksmbd_user_session_get(struct ksmbd_session *sess); +void ksmbd_user_session_put(struct ksmbd_session *sess); #endif /* __USER_SESSION_MANAGEMENT_H__ */ |