ksmbd: call rcu_barrier() in ksmbd_server_exit()
authorNamjae Jeon <linkinjeon@kernel.org>
Tue, 2 May 2023 23:51:51 +0000 (08:51 +0900)
committerSteve French <stfrench@microsoft.com>
Thu, 4 May 2023 04:03:02 +0000 (23:03 -0500)
commiteb307d09fe15844fdaebeb8cc8c9b9e925430aa5
tree2d39595c973c37f921b91c933f7c84e194788d63
parent30210947a343b6b3ca13adc9bfc88e1543e16dd5
ksmbd: call rcu_barrier() in ksmbd_server_exit()

racy issue is triggered the bug by racing between closing a connection
and rmmod. In ksmbd, rcu_barrier() is not called at module unload time,
so nothing prevents ksmbd from getting unloaded while it still has RCU
callbacks pending. It leads to trigger unintended execution of kernel
code locally and use to defeat protections such as Kernel Lockdown

Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20477
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/ksmbd/server.c