diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2023-05-03 02:51:12 +0300 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2023-05-04 07:03:02 +0300 |
| commit | 30210947a343b6b3ca13adc9bfc88e1543e16dd5 (patch) | |
| tree | b975ba955a52288885c013b107e7114523c3c24b /fs/ksmbd/mgmt/tree_connect.c | |
| parent | abcc506a9a71976a8b4c9bf3ee6efd13229c1e19 (diff) | |
| download | linux-30210947a343b6b3ca13adc9bfc88e1543e16dd5.tar.xz | |
ksmbd: fix racy issue under cocurrent smb2 tree disconnect
There is UAF issue under cocurrent smb2 tree disconnect.
This patch introduce TREE_CONN_EXPIRE flags for tcon to avoid cocurrent
access.
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20592
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/ksmbd/mgmt/tree_connect.c')
| -rw-r--r-- | fs/ksmbd/mgmt/tree_connect.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/fs/ksmbd/mgmt/tree_connect.c b/fs/ksmbd/mgmt/tree_connect.c index aa9c138d5851..f07a05f37651 100644 --- a/fs/ksmbd/mgmt/tree_connect.c +++ b/fs/ksmbd/mgmt/tree_connect.c @@ -109,7 +109,15 @@ int ksmbd_tree_conn_disconnect(struct ksmbd_session *sess, struct ksmbd_tree_connect *ksmbd_tree_conn_lookup(struct ksmbd_session *sess, unsigned int id) { - return xa_load(&sess->tree_conns, id); + struct ksmbd_tree_connect *tcon; + + tcon = xa_load(&sess->tree_conns, id); + if (tcon) { + if (test_bit(TREE_CONN_EXPIRE, &tcon->status)) + tcon = NULL; + } + + return tcon; } struct ksmbd_share_config *ksmbd_tree_conn_share(struct ksmbd_session *sess, |