ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
authorNamjae Jeon <linkinjeon@kernel.org>
Sat, 13 Jan 2024 06:30:07 +0000 (15:30 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 25 Jan 2024 23:35:44 +0000 (15:35 -0800)
commit24290ba94cd0136e417283b0dbf8fcdabcf62111
tree9130d723c76ebc559b3be93c9878408b4e13eab9
parenta2b21ef1ea4cf632d19b3a7cc4d4245b8e63202a
ksmbd: fix UAF issue in ksmbd_tcp_new_connection()

commit 38d20c62903d669693a1869aa68c4dd5674e2544 upstream.

The race is between the handling of a new TCP connection and
its disconnection. It leads to UAF on `struct tcp_transport` in
ksmbd_tcp_new_connection() function.

Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-22991
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/smb/server/connection.c
fs/smb/server/connection.h
fs/smb/server/transport_rdma.c
fs/smb/server/transport_tcp.c