kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity

ksmbd: implement the command sequence window

Browse source 
ksmbd tracked only credit counts (total_credits/outstanding_credits) and
never validated the MessageId of an incoming request. As a result a
request carrying a MessageId outside the granted range was accepted, a
MessageId could be replayed, and a 64-bit sequence wrap was not detected.

Maintain a command sequence window per connection:

  - [seq_low, seq_high) is the range of granted sequence numbers and
    seq_bitmap records which of them have been granted but not yet
    consumed. The window starts as { 0 } at connection setup.
  - smb2_set_rsp_credits() extends seq_high by the number of credits it
    grants (setting the corresponding bits), capped so the window never
    spans more than KSMBD_CMD_SEQ_WINDOW (== SMB2_MAX_CREDITS) sequence
    numbers. This implements the "limit the range of acceptable
    sequence numbers" allowance and keeps seq_bitmap usable as a ring.
  - smb2_check_sequence_number(), run for every SMB2 request from
    ksmbd_smb2_check_message(), verifies that the CreditCharge
    consecutive sequence numbers starting at MessageId lie within the
    window and have not already been consumed, then removes them and
    slides seq_low forward. CANCEL consumes nothing. A violation
    (out of window, replay, or wrap) tears the connection down.

The legacy SMB1 multi-protocol negotiate occupies sequence number 0 but
does not pass through ksmbd_smb2_check_message(), so it consumes that
sequence number explicitly; otherwise seq_low would stay pinned at 0
after the upgrade to SMB2 and eventually stall credit grants.

For an in-order client seq_high - seq_low equals total_credits, so the
window-room cap never reduces the number of credits granted. it only
engages for a client that withholds low sequence numbers.
init_smb2_max_credits() now clamps the configured maximum to
SMB2_MAX_CREDITS so the window (and its bitmap) can always represent
every outstanding sequence number.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
This commit is contained in:
Namjae Jeon 2026-07-13 21:55:58 +09:00
commit fd8c97d7c1
6 changed files with 146 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files