ksmbd: fix race condition between session lookup and expire
authorNamjae Jeon <linkinjeon@kernel.org>
Wed, 4 Oct 2023 09:25:01 +0000 (18:25 +0900)
committerSteve French <stfrench@microsoft.com>
Thu, 5 Oct 2023 01:21:48 +0000 (20:21 -0500)
commit53ff5cf89142b978b1a5ca8dc4d4425e6a09745f
tree108b6e8f2851d06b3ed9ad4d83d09e29aad2f107
parent8a749fd1a8720d4619c91c8b6e7528c0a355c0aa
ksmbd: fix race condition between session lookup and expire

 Thread A                        +  Thread B
 ksmbd_session_lookup            |  smb2_sess_setup
   sess = xa_load                |
                                 |
                                 |    xa_erase(&conn->sessions, sess->id);
                                 |
                                 |    ksmbd_session_destroy(sess) --> kfree(sess)
                                 |
   // UAF!                       |
   sess->last_active = jiffies   |
                                 +

This patch add rwsem to fix race condition between ksmbd_session_lookup
and ksmbd_expire_session.

Reported-by: luosili <rootlab@huawei.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/connection.c
fs/smb/server/connection.h
fs/smb/server/mgmt/user_session.c