github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-13 13:51:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ksmbd: free preauth sessions on connection teardown

Browse Source 
SMB3.1.1 multichannel binding preserves the preauthentication hash in a
preauth_session between the NTLM negotiate and authenticate requests.
The binding NTLM negotiate allocates this object and returns
STATUS_MORE_PROCESSING_REQUIRED. If the client disconnects before it sends
the authenticate request, neither the authenticate nor error cleanup paths
free the object.

Release any remaining preauthentication sessions when tearing down the
connection. Initialize the list when allocating the connection so that this
cleanup is safe regardless of the negotiated dialect.

Reported-by: Runa Takemoto <takemotoruna223@gmail.com>
Fixes: f5a544e3ba ("ksmbd: add support for SMB3 multichannel")
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
This commit is contained in:
Namjae Jeon 2026-07-24 11:17:30 +09:00
parent 528af7cf69
commit 06c7b1d731
4 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fs/smb/server/connection.c
View File

@ -11,6 +11,7 @@
#include "server.h"
#include "smb_common.h"
#include "mgmt/ksmbd_ida.h"
#include "mgmt/user_session.h"
#include "connection.h"
#include "compress.h"
#include "transport_tcp.h"
@ -257,6 +258,7 @@ void ksmbd_conn_free(struct ksmbd_conn *conn)
kvfree(conn->request_buf);
kfree(conn->preauth_info);
kfree(conn->mechToken);
ksmbd_preauth_session_destroy(conn);
ksmbd_conn_put(conn);
}
@ -303,6 +305,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void)
init_waitqueue_head(&conn->r_count_q);
INIT_LIST_HEAD(&conn->requests);
INIT_LIST_HEAD(&conn->async_requests);
INIT_LIST_HEAD(&conn->preauth_sess_table);
spin_lock_init(&conn->request_lock);
spin_lock_init(&conn->credits_lock);
ida_init(&conn->async_ida);

11
fs/smb/server/mgmt/user_session.c
View File

@ -600,6 +600,17 @@ struct preauth_session *ksmbd_preauth_session_alloc(struct ksmbd_conn *conn,
return sess;
}
void ksmbd_preauth_session_destroy(struct ksmbd_conn *conn)
{
struct preauth_session *sess, *tmp;
list_for_each_entry_safe(sess, tmp, &conn->preauth_sess_table,
preauth_entry) {
list_del(&sess->preauth_entry);
kfree(sess);
}
}
void destroy_previous_session(struct ksmbd_conn *conn,
struct ksmbd_user *user, u64 id)
{

1
fs/smb/server/mgmt/user_session.h
View File

@ -104,6 +104,7 @@ void destroy_previous_session(struct ksmbd_conn *conn,
struct ksmbd_user *user, u64 id);
struct preauth_session *ksmbd_preauth_session_alloc(struct ksmbd_conn *conn,
u64 sess_id);
void ksmbd_preauth_session_destroy(struct ksmbd_conn *conn);
struct preauth_session *ksmbd_preauth_session_lookup(struct ksmbd_conn *conn,
unsigned long long id);

2
fs/smb/server/smb2ops.c
View File

@ -297,8 +297,6 @@ int init_smb3_11_server(struct ksmbd_conn *conn)
conn->vals->req_capabilities |= SMB2_GLOBAL_CAP_MULTI_CHANNEL;
/* See init_smb3_02_server(): persistent handles require CA recovery. */
INIT_LIST_HEAD(&conn->preauth_sess_table);
return 0;
}