Namjae Jeon a9839c37fd ksmbd: fix user-after-free from session log off ...

commit 7aa8804c0b67b3cb263a472d17f2cb50d7f1a930 upstream.

There is racy issue between smb2 session log off and smb2 session setup.
It will cause user-after-free from session log off.
This add session_lock when setting SMB2_SESSION_EXPIRED and referece
count to session struct not to free session while it is being used.

Cc: stable@vger.kernel.org # v5.15+
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-25282
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-10-22 15:56:39 +02:00

..

mgmt

ksmbd: fix user-after-free from session log off

2024-10-22 15:56:39 +02:00

asn1.c

…

asn1.h

…

auth.c

…

auth.h

…

connection.c

…

connection.h

…

crypto_ctx.c

…

crypto_ctx.h

…

glob.h

…

Kconfig

…

ksmbd_netlink.h

…

ksmbd_spnego_negtokeninit.asn1

…

ksmbd_spnego_negtokentarg.asn1

…

ksmbd_work.c

…

ksmbd_work.h

…

Makefile

…

misc.c

…

misc.h

…

ndr.c

…

ndr.h

…

nterr.h

…

ntlmssp.h

…

oplock.c

ksmbd: avoid to send duplicate oplock break notifications

2024-06-12 11:02:57 +02:00

oplock.h

…

server.c

ksmbd: fix user-after-free from session log off

2024-10-22 15:56:39 +02:00

server.h

…

smb2misc.c

…

smb2ops.c

…

smb2pdu.c

ksmbd: fix user-after-free from session log off

2024-10-22 15:56:39 +02:00

smb2pdu.h

…

smb_common.c

ksmbd: override fsids for share path check

2024-09-18 19:23:02 +02:00

smb_common.h

ksmbd: override fsids for share path check

2024-09-18 19:23:02 +02:00

smbacl.c

…

smbacl.h

…

smbfsctl.h

…

smbstatus.h

…

transport_ipc.c

…

transport_ipc.h

…

transport_rdma.c

…

transport_rdma.h

…

transport_tcp.c

ksmbd: Unlock on in ksmbd_tcp_set_interfaces()

2024-09-12 11:10:16 +02:00

transport_tcp.h

…

unicode.c

…

unicode.h

…

uniupr.h

…

vfs_cache.c

…

vfs_cache.h

…

vfs.c

ksmbd: handle caseless file creation

2024-10-17 15:21:18 +02:00

vfs.h

…

xattr.h

…