diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2025-04-17 10:10:15 +0900 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2025-04-22 20:45:43 -0500 |
| commit | a1f46c99d9ea411f9bf30025b912d881d36fc709 (patch) | |
| tree | 7d816024d2fc814e3ea4a482d3d1dc64d3b5016e /fs/smb/server/mgmt/user_session.h | |
| parent | af5226abb40cae959f424f7ca614787a1c87ce48 (diff) | |
ksmbd: fix use-after-free in ksmbd_session_rpc_open
A UAF issue can occur due to a race condition between
ksmbd_session_rpc_open() and __session_rpc_close().
Add rpc_lock to the session to protect it.
Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei <norbert@doyensec.com>
Tested-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/smb/server/mgmt/user_session.h')
| -rw-r--r-- | fs/smb/server/mgmt/user_session.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/smb/server/mgmt/user_session.h b/fs/smb/server/mgmt/user_session.h index f21348381d59..c5749d6ec715 100644 --- a/fs/smb/server/mgmt/user_session.h +++ b/fs/smb/server/mgmt/user_session.h @@ -63,6 +63,7 @@ struct ksmbd_session { rwlock_t tree_conns_lock; atomic_t refcnt; + struct rw_semaphore rpc_lock; }; static inline int test_session_flag(struct ksmbd_session *sess, int bit) |