Namjae Jeon 4aba9ab6a0 ksmbd: fix racy issue from smb2 close and logoff with multichannel ...

[ Upstream commit abcc506a9a71976a8b4c9bf3ee6efd13229c1e19 ]

When smb client send concurrent smb2 close and logoff request
with multichannel connection, It can cause racy issue. logoff request
free tcon and can cause UAF issues in smb2 close. When receiving logoff
request with multichannel, ksmbd should wait until all remaning requests
complete as well as ones in the current connection, and then make
session expired.

Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20796 ZDI-CAN-20595
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-05-17 11:53:57 +02:00

..

ksmbd_ida.c

…

ksmbd_ida.h

…

share_config.c

ksmbd: validate share name from share config response

2022-10-05 01:15:44 -05:00

share_config.h

ksmbd: validate share name from share config response

2022-10-05 01:15:44 -05:00

tree_connect.c

ksmbd: fix racy issue from smb2 close and logoff with multichannel

2023-05-17 11:53:57 +02:00

tree_connect.h

ksmbd: fix racy issue under cocurrent smb2 tree disconnect

2023-05-11 23:03:03 +09:00

user_config.c

ksmbd: set RSS capable in FSCTL_QUERY_NETWORK_INTERFACE_INFO

2021-12-28 22:47:22 -06:00

user_config.h

ksmbd: set RSS capable in FSCTL_QUERY_NETWORK_INTERFACE_INFO

2021-12-28 22:47:22 -06:00

user_session.c

ksmbd: fix racy issue from smb2 close and logoff with multichannel

2023-05-17 11:53:57 +02:00

user_session.h

ksmbd: destroy expired sessions

2023-05-17 11:53:56 +02:00