diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2024-01-13 09:30:07 +0300 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2024-01-14 20:39:49 +0300 |
| commit | 38d20c62903d669693a1869aa68c4dd5674e2544 (patch) | |
| tree | 8d19ec9f1163a00975306e5acbe7e2a4298deec9 /fs/smb/server/connection.c | |
| parent | 92e470163d96df8db6c4fa0f484e4a229edb903d (diff) | |
| download | linux-38d20c62903d669693a1869aa68c4dd5674e2544.tar.xz | |
ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
The race is between the handling of a new TCP connection and
its disconnection. It leads to UAF on `struct tcp_transport` in
ksmbd_tcp_new_connection() function.
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-22991
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/smb/server/connection.c')
| -rw-r--r-- | fs/smb/server/connection.c | 6 |
1 files changed, 0 insertions, 6 deletions
diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c index d311c2ee10bd..09e1e7771592 100644 --- a/fs/smb/server/connection.c +++ b/fs/smb/server/connection.c @@ -416,13 +416,7 @@ static void stop_sessions(void) again: down_read(&conn_list_lock); list_for_each_entry(conn, &conn_list, conns_list) { - struct task_struct *task; - t = conn->transport; - task = t->handler; - if (task) - ksmbd_debug(CONN, "Stop session handler %s/%d\n", - task->comm, task_pid_nr(task)); ksmbd_conn_set_exiting(conn); if (t->ops->shutdown) { up_read(&conn_list_lock); |