ksmbd: fix race condition between tree conn lookup and disconnect
authorNamjae Jeon <linkinjeon@kernel.org>
Thu, 5 Oct 2023 02:22:03 +0000 (11:22 +0900)
committerSteve French <stfrench@microsoft.com>
Thu, 5 Oct 2023 02:56:28 +0000 (21:56 -0500)
commit33b235a6e6ebe0f05f3586a71e8d281d00f71e2e
treeda5a5b5679aa447860e4581d4773b72fc04924e8
parent75ac9a3dd65f7eab4d12b0a0f744234b5300a491
ksmbd: fix race condition between tree conn lookup and disconnect

if thread A in smb2_write is using work-tcon, other thread B use
smb2_tree_disconnect free the tcon, then thread A will use free'd tcon.

                            Time
                             +
 Thread A                    | Thread A
 smb2_write                  | smb2_tree_disconnect
                             |
                             |
                             |   kfree(tree_conn)
                             |
  // UAF!                    |
  work->tcon->share_conf     |
                             +

This patch add state, reference count and lock for tree conn to fix race
condition issue.

Reported-by: luosili <rootlab@huawei.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/mgmt/tree_connect.c
fs/smb/server/mgmt/tree_connect.h
fs/smb/server/mgmt/user_session.c
fs/smb/server/mgmt/user_session.h
fs/smb/server/server.c
fs/smb/server/smb2pdu.c