ksmbd: fix race condition between destroy_previous_session() and smb2 operations()
authorNamjae Jeon <linkinjeon@kernel.org>
Sat, 17 Aug 2024 05:03:49 +0000 (14:03 +0900)
committerSteve French <stfrench@microsoft.com>
Sun, 18 Aug 2024 22:02:36 +0000 (17:02 -0500)
commit76e98a158b207771a6c9a0de0a60522a446a3447
tree92b7c2596874cc7f0536d18d2135b0b6b30c6849
parentdfd046d0ced19b6ff5f11ec4ceab0a83de924771
ksmbd: fix race condition between destroy_previous_session() and smb2 operations()

If there is ->PreviousSessionId field in the session setup request,
The session of the previous connection should be destroyed.
During this, if the smb2 operation requests in the previous session are
being processed, a racy issue could happen with ksmbd_destroy_file_table().
This patch sets conn->status to KSMBD_SESS_NEED_RECONNECT to block
incoming  operations and waits until on-going operations are complete
(i.e. idle) before desctorying the previous session.

Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2")
Cc: stable@vger.kernel.org # v6.6+
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-25040
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/server/connection.c
fs/smb/server/connection.h
fs/smb/server/mgmt/user_session.c
fs/smb/server/smb2pdu.c