ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()

When per-session tree_conn_ida was converted from a dynamically
allocated ksmbd_ida to an embedded struct ida, ksmbd_ida_free() was
removed from ksmbd_session_destroy() but no matching ida_destroy()
was added.  The session is therefore freed with the IDA's backing
xarray still intact.

The kernel IDA API expects ida_init() and ida_destroy() to be paired
over an object's lifetime, so add the missing cleanup before the
enclosing session is freed.

Also move ida_init() to right after the session is allocated so that
it is always paired with the destroy call even on the early error
paths of __session_create() (ksmbd_init_file_table() or
__init_smb2_session() failures), both of which jump to the error
label and invoke ksmbd_session_destroy() on a partially initialised
session.

No leak has been observed in testing; this is a pairing fix to match
the IDA lifetime rules, not a response to a reproduced regression.

Fixes: d40012a83f87 ("cifsd: declare ida statically")
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c
index a86589408835bcb7b9ff7f3e11dd14d2b129f4c8..0dd9e6c976ac0f186e683bc0cac0acac5074c634 100644 (file)
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -391,6 +391,7 @@ void ksmbd_session_destroy(struct ksmbd_session *sess)
        free_channel_list(sess);
        kfree(sess->Preauth_HashValue);
        ksmbd_release_id(&session_ida, sess->id);
+       ida_destroy(&sess->tree_conn_ida);
        kfree(sess);
 }
 
@@ -665,6 +666,8 @@ static struct ksmbd_session *__session_create(int protocol)
        if (!sess)
                return NULL;
 
+       ida_init(&sess->tree_conn_ida);
+
        if (ksmbd_init_file_table(&sess->file_table))
                goto error;
 
@@ -684,8 +687,6 @@ static struct ksmbd_session *__session_create(int protocol)
        if (ret)
                goto error;
 
-       ida_init(&sess->tree_conn_ida);
-
        down_write(&sessions_table_lock);
        hash_add(sessions_table, &sess->hlist, sess->id);
        up_write(&sessions_table_lock);