]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ksmbd: fix race condition from parallel smb2 lock requests
authorNamjae Jeon <linkinjeon@kernel.org>
Wed, 4 Oct 2023 09:31:03 +0000 (18:31 +0900)
committerSteve French <stfrench@microsoft.com>
Thu, 5 Oct 2023 01:21:48 +0000 (20:21 -0500)
commit75ac9a3dd65f7eab4d12b0a0f744234b5300a491
treec54b6fd1e2697dbfd7917749fceb433e9bf4ae9f
parent7ca9da7d873ee8024e9548d3366101c2b6843eab
ksmbd: fix race condition from parallel smb2 lock requests

There is a race condition issue between parallel smb2 lock request.

                                            Time
                                             +
Thread A                                     | Thread A
smb2_lock                                    | smb2_lock
                                             |
 insert smb_lock to lock_list                |
 spin_unlock(&work->conn->llist_lock)        |
                                             |
                                             |   spin_lock(&conn->llist_lock);
                                             |   kfree(cmp_lock);
                                             |
 // UAF!                                     |
 list_add(&smb_lock->llist, &rollback_list)  +

This patch swaps the line for adding the smb lock to the rollback list and
adding the lock list of connection to fix the race issue.

Reported-by: luosili <rootlab@huawei.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/smb2pdu.c