Skip to content

Commit

Permalink
ksmbd: add free_transport ops in ksmbd connection
Browse files Browse the repository at this point in the history
[ Upstream commit a89f5fa ]

free_transport function for tcp connection can be called from smbdirect.
It will cause kernel oops. This patch add free_transport ops in ksmbd
connection, and add each free_transports for tcp and smbdirect.

Fixes: 21a4e47 ("ksmbd: fix use-after-free in __smb2_lease_break_noti()")
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
  • Loading branch information
Namjae Jeon authored and Greg Kroah-Hartman committed Jun 27, 2025
1 parent e20f4eb commit 3f3aae7
Show file tree
Hide file tree
Showing 4 changed files with 12 additions and 4 deletions.
2 changes: 1 addition & 1 deletion fs/smb/server/connection.c
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ void ksmbd_conn_free(struct ksmbd_conn *conn)
kvfree(conn->request_buf);
kfree(conn->preauth_info);
if (atomic_dec_and_test(&conn->refcnt)) {
ksmbd_free_transport(conn->transport);
conn->transport->ops->free_transport(conn->transport);
kfree(conn);
}
}
Expand Down
1 change: 1 addition & 0 deletions fs/smb/server/connection.h
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,7 @@ struct ksmbd_transport_ops {
void *buf, unsigned int len,
struct smb2_buffer_desc_v1 *desc,
unsigned int desc_len);
void (*free_transport)(struct ksmbd_transport *kt);
};

struct ksmbd_transport {
Expand Down
10 changes: 8 additions & 2 deletions fs/smb/server/transport_rdma.c
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,8 @@ struct smb_direct_transport {
};

#define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))

#define SMBD_TRANS(t) ((struct smb_direct_transport *)container_of(t, \
struct smb_direct_transport, transport))
enum {
SMB_DIRECT_MSG_NEGOTIATE_REQ = 0,
SMB_DIRECT_MSG_DATA_TRANSFER
Expand Down Expand Up @@ -410,6 +411,11 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
return NULL;
}

static void smb_direct_free_transport(struct ksmbd_transport *kt)
{
kfree(SMBD_TRANS(kt));
}

static void free_transport(struct smb_direct_transport *t)
{
struct smb_direct_recvmsg *recvmsg;
Expand Down Expand Up @@ -455,7 +461,6 @@ static void free_transport(struct smb_direct_transport *t)

smb_direct_destroy_pools(t);
ksmbd_conn_free(KSMBD_TRANS(t)->conn);
kfree(t);
}

static struct smb_direct_sendmsg
Expand Down Expand Up @@ -2281,4 +2286,5 @@ static const struct ksmbd_transport_ops ksmbd_smb_direct_transport_ops = {
.read = smb_direct_read,
.rdma_read = smb_direct_rdma_read,
.rdma_write = smb_direct_rdma_write,
.free_transport = smb_direct_free_transport,
};
3 changes: 2 additions & 1 deletion fs/smb/server/transport_tcp.c
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ static struct tcp_transport *alloc_transport(struct socket *client_sk)
return t;
}

void ksmbd_free_transport(struct ksmbd_transport *kt)
static void ksmbd_tcp_free_transport(struct ksmbd_transport *kt)
{
struct tcp_transport *t = TCP_TRANS(kt);

Expand Down Expand Up @@ -656,4 +656,5 @@ static const struct ksmbd_transport_ops ksmbd_tcp_transport_ops = {
.read = ksmbd_tcp_read,
.writev = ksmbd_tcp_writev,
.disconnect = ksmbd_tcp_disconnect,
.free_transport = ksmbd_tcp_free_transport,
};

0 comments on commit 3f3aae7

Please sign in to comment.