diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2025-04-11 09:19:46 +0300 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2025-04-15 06:21:26 +0300 |
| commit | 21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de (patch) | |
| tree | 7ba00540ed13ec8720c02e8a3ffab0f161905af8 /rust/helpers/build_assert.c | |
| parent | 1df0d4c616138784e033ad337961b6e1a6bcd999 (diff) | |
| download | linux-21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de.tar.xz | |
ksmbd: fix use-after-free in __smb2_lease_break_noti()
Move tcp_transport free to ksmbd_conn_free. If ksmbd connection is
referenced when ksmbd server thread terminates, It will not be freed,
but conn->tcp_transport is freed. __smb2_lease_break_noti can be performed
asynchronously when the connection is disconnected. __smb2_lease_break_noti
calls ksmbd_conn_write, which can cause use-after-free
when conn->ksmbd_transport is already freed.
Cc: stable@vger.kernel.org
Reported-by: Norbert Szetei <norbert@doyensec.com>
Tested-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'rust/helpers/build_assert.c')
0 files changed, 0 insertions, 0 deletions