]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ksmbd: fix UAF issue from opinfo->conn
authorNamjae Jeon <linkinjeon@kernel.org>
Fri, 19 May 2023 14:09:48 +0000 (23:09 +0900)
committerSteve French <stfrench@microsoft.com>
Sat, 27 May 2023 01:27:46 +0000 (20:27 -0500)
commit36322523dddb11107e9f7f528675a0dec2536103
tree5cbdf837cda3e64fde146a6712f106d9bfe5939a
parent0512a5f89e1fae74251fde6893ff634f1c96c6fb
ksmbd: fix UAF issue from opinfo->conn

If opinfo->conn is another connection and while ksmbd send oplock break
request to cient on current connection, The connection for opinfo->conn
can be disconnect and conn could be freed. When sending oplock break
request, this ksmbd_conn can be used and cause user-after-free issue.
When getting opinfo from the list, ksmbd check connection is being
released. If it is not released, Increase ->r_count to wait that connection
is freed.

Cc: stable@vger.kernel.org
Reported-by: Per Forlin <per.forlin@axis.com>
Tested-by: Per Forlin <per.forlin@axis.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/oplock.c