ksmbd: fix durable reconnect error path file lifetime

[ Upstream commit 3515503322f4819277091839eed46b695096aca5 ]

After a durable reconnect succeeds, ksmbd_reopen_durable_fd() republishes
the same ksmbd_file into the session volatile-id table. If smb2_open()
then takes a later error path, cleanup first calls ksmbd_fd_put(work, fp)
and then unconditionally calls ksmbd_put_durable_fd(dh_info.fp).

In this case fp and dh_info.fp are the same object. The first put drops the
reconnect lookup reference, but the final durable put can run
__ksmbd_close_fd(NULL, fp). Because the final close is not session-aware,
it can free the file object without removing the volatile-id entry that was
just published into the session table.

Use the session-aware put for the final reconnect drop when the reconnect
had already succeeded and the error path is cleaning up the republished
file. Earlier reconnect failures, before fp is assigned to dh_info.fp, keep
using the durable-only put path.

Fixes: 1baff47b81f9 ("ksmbd: fix use-after-free in smb2_open during durable reconnect")
Signed-off-by: Junyi Liu <moss80199@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index c3c7688f0fa80b0204a975a3776aa8c121db6e10..3a8a739c025fb706590dd356f313aa4981ec69d5 100644 (file)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -3803,8 +3803,19 @@ err_out2:
                ksmbd_debug(SMB, "Error response: %x\n", rsp->hdr.Status);
        }
 
-       if (dh_info.reconnected)
-               ksmbd_put_durable_fd(dh_info.fp);
+       if (dh_info.reconnected) {
+               /*
+                * If reconnect succeeded, fp was republished in the
+                * session file table.  On a later error, ksmbd_fd_put()
+                * above drops the session reference; drop the durable
+                * lookup reference through the same session-aware path so
+                * final close removes the volatile id before freeing fp.
+                */
+               if (rc && fp == dh_info.fp)
+                       ksmbd_fd_put(work, dh_info.fp);
+               else
+                       ksmbd_put_durable_fd(dh_info.fp);
+       }
 
        kfree(name);
        kfree(lc);