]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ksmbd: close accepted socket when per-IP limit rejects connection
authorJoshua Rogers <linux@joshua.hu>
Sat, 8 Nov 2025 14:59:23 +0000 (22:59 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 6 Dec 2025 21:12:35 +0000 (06:12 +0900)
commit7a3c7154d5fc05956a8ad9e72ecf49e21555bfca
tree7117466a11c2c959a0ee01e23d02bc667cc91a6f
parent3deeb58c1340c95060bd922126bce25c0b1037fb
ksmbd: close accepted socket when per-IP limit rejects connection

commit 98a5fd31cbf72d46bf18e50b3ab0ce86d5f319a9 upstream.

When the per-IP connection limit is exceeded in ksmbd_kthread_fn(),
the code sets ret = -EAGAIN and continues the accept loop without
closing the just-accepted socket. That leaks one socket per rejected
attempt from a single IP and enables a trivial remote DoS.

Release client_sk before continuing.

This bug was found with ZeroPath.

Cc: stable@vger.kernel.org
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/smb/server/transport_tcp.c