ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency

Browse source

Under high concurrency, A tree-connection object (tcon) is freed on
a disconnect path while another path still holds a reference and later
executes *_put()/write on it.

Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
Reported-by: Zhitong Liu <liuzhitong1993@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

...

This commit is contained in:

Namjae Jeon 2025-11-18 09:05:46 +09:00 • committed by Steve French

parent 3316a8fc84

commit b39a1833cc

3 changed files with 4 additions and 18 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

18

fs/smb/server/mgmt/tree_connect.c

View file

1

fs/smb/server/mgmt/tree_connect.h

View file

3

fs/smb/server/smb2pdu.c

View file