]> git.ipfire.org Git - thirdparty/linux.git/commit
ksmbd: add chann_lock to protect ksmbd_chann_list xarray
authorNamjae Jeon <linkinjeon@kernel.org>
Mon, 9 Feb 2026 01:43:19 +0000 (10:43 +0900)
committerSteve French <stfrench@microsoft.com>
Mon, 9 Feb 2026 15:03:04 +0000 (09:03 -0600)
commit4f3a06cc57976cafa8c6f716646be6c79a99e485
tree90d86d012d3051905937f2eff7605c2b04ffaf2a
parent164cacd0ba380604253b96dc312c85366147e3f7
ksmbd: add chann_lock to protect ksmbd_chann_list xarray

ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in
multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del).

Adds rw_semaphore chann_lock to struct ksmbd_session and protects
all xa_load/xa_store/xa_erase accesses.

Cc: stable@vger.kernel.org
Reported-by: Igor Stepansky <igor.stepansky@orca.security>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/mgmt/user_session.c
fs/smb/server/mgmt/user_session.h
fs/smb/server/smb2pdu.c