github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 13:14:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ksmbd: fix encrypted request lookup on bound channels

Browse Source 
An SMB3 multichannel binding registers the secondary connection in the
session channel list, but does not insert the session into the secondary
connection's session xarray.

The decryption path only searches the connection-local xarray.  As a
result, every encrypted request received on a bound channel fails with
"Could not get decryption key".

Use the channel-aware session lookup for decryption.  Also stop using the
temporary conn->binding flag to decide whether the global lookup is
allowed.  Validate the permanent channel association under chann_lock
instead.

Fixes: f5a544e3ba ("ksmbd: add support for SMB3 multichannel")
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
This commit is contained in:
Namjae Jeon 2026-08-13 09:00:00 +09:00
parent 50a400cff5
commit 2cbd4a8bf4
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/smb/server/auth.c
View File

@ -729,7 +729,7 @@ static int ksmbd_get_encryption_key(struct ksmbd_work *work, __u64 ses_id,
* that the command can reach the session setup handler. Other
* commands are rejected there with STATUS_NETWORK_SESSION_EXPIRED.
*/
sess = ksmbd_session_lookup(work->conn, ses_id);
sess = ksmbd_session_lookup_all_states(work->conn, ses_id);
if (sess && sess->state != SMB2_SESSION_VALID &&
(sess->state != SMB2_SESSION_EXPIRED ||
!sess->kerberos_expiry)) {

11
fs/smb/server/mgmt/user_session.c
View File

@ -551,11 +551,18 @@ struct ksmbd_session *ksmbd_session_lookup_all_states(struct ksmbd_conn *conn,
unsigned long long id)
{
struct ksmbd_session *sess;
bool channel_found;
sess = ksmbd_session_lookup(conn, id);
if (!sess && conn->binding) {
if (!sess) {
sess = ksmbd_session_lookup_slowpath(id);
if (sess && !xa_load(&sess->ksmbd_chann_list, (long)conn)) {
if (!sess)
return NULL;
down_read(&sess->chann_lock);
channel_found = xa_load(&sess->ksmbd_chann_list, (long)conn);
up_read(&sess->chann_lock);
if (!channel_found) {
ksmbd_user_session_put(sess);
sess = NULL;
}