github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 10:09:10 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ksmbd: track the connection owning a byte-range lock

Browse Source 
SMB2_LOCK adds each granted byte-range lock to both the file lock list
and the lock list of the connection which handled the request.  The
final close and durable handle paths, however, remove the connection
list entry while holding fp->conn->llist_lock.

With SMB3 multichannel, the connection handling the LOCK request can be
different from the connection which opened the file.  The entry can
therefore be removed under a different spinlock from the one protecting
the list it belongs to.  A concurrent traversal can then access freed
struct ksmbd_lock and struct file_lock objects.

Record the connection owning each lock's clist entry and hold a
reference to it while the entry is linked.  Use that connection and its
llist_lock for unlock, rollback, close, and durable preserve.  Durable
reconnect assigns the new connection as the owner when publishing the
locks again.

Fixes: f5a544e3ba ("ksmbd: add support for SMB3 multichannel")
Cc: stable@vger.kernel.org
Reported-by: Musaab Khan <musaab.khan@protonmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Namjae Jeon 2026-06-15 10:00:00 +09:00 committed by Steve French
parent dac3b26eae
commit c1016dd1d8
3 changed files with 26 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fs/smb/server/smb2pdu.c
View File

@ -7774,9 +7774,11 @@ int smb2_lock(struct ksmbd_work *work)
nolock = 0;
list_del(&cmp_lock->flist);
list_del(&cmp_lock->clist);
cmp_lock->conn = NULL;
spin_unlock(&conn->llist_lock);
up_read(&conn_list_lock);
ksmbd_conn_put(conn);
locks_free_lock(cmp_lock->fl);
kfree(cmp_lock);
goto out_check_cl;
@ -7911,6 +7913,7 @@ int smb2_lock(struct ksmbd_work *work)
goto out2;
} else if (!rc) {
list_add(&smb_lock->llist, &rollback_list);
smb_lock->conn = ksmbd_conn_get(work->conn);
spin_lock(&work->conn->llist_lock);
list_add_tail(&smb_lock->clist,
&work->conn->lock_list);
@ -7965,11 +7968,14 @@ int smb2_lock(struct ksmbd_work *work)
}
list_del(&smb_lock->llist);
spin_lock(&work->conn->llist_lock);
conn = smb_lock->conn;
spin_lock(&conn->llist_lock);
if (!list_empty(&smb_lock->flist))
list_del(&smb_lock->flist);
list_del(&smb_lock->clist);
spin_unlock(&work->conn->llist_lock);
smb_lock->conn = NULL;
spin_unlock(&conn->llist_lock);
ksmbd_conn_put(conn);
locks_free_lock(smb_lock->fl);
if (rlock)

23
fs/smb/server/vfs_cache.c
View File

@ -484,10 +484,14 @@ static void __ksmbd_close_fd(struct ksmbd_file_table *ft, struct ksmbd_file *fp)
* there are not accesses to fp->lock_list.
*/
list_for_each_entry_safe(smb_lock, tmp_lock, &fp->lock_list, flist) {
if (!list_empty(&smb_lock->clist) && fp->conn) {
spin_lock(&fp->conn->llist_lock);
list_del(&smb_lock->clist);
spin_unlock(&fp->conn->llist_lock);
struct ksmbd_conn *conn = smb_lock->conn;
if (conn) {
spin_lock(&conn->llist_lock);
list_del_init(&smb_lock->clist);
smb_lock->conn = NULL;
spin_unlock(&conn->llist_lock);
ksmbd_conn_put(conn);
}
list_del(&smb_lock->flist);
@ -1303,9 +1307,15 @@ static bool session_fd_check(struct ksmbd_tree_connect *tcon,
up_write(&ci->m_lock);
list_for_each_entry_safe(smb_lock, tmp_lock, &fp->lock_list, flist) {
spin_lock(&conn->llist_lock);
struct ksmbd_conn *lock_conn = smb_lock->conn;
if (!lock_conn)
continue;
spin_lock(&lock_conn->llist_lock);
list_del_init(&smb_lock->clist);
spin_unlock(&conn->llist_lock);
smb_lock->conn = NULL;
spin_unlock(&lock_conn->llist_lock);
ksmbd_conn_put(lock_conn);
}
fp->conn = NULL;
@ -1435,6 +1445,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp)
}
list_for_each_entry(smb_lock, &fp->lock_list, flist) {
smb_lock->conn = ksmbd_conn_get(conn);
spin_lock(&conn->llist_lock);
list_add_tail(&smb_lock->clist, &conn->lock_list);
spin_unlock(&conn->llist_lock);

1
fs/smb/server/vfs_cache.h
View File

@ -32,6 +32,7 @@ struct ksmbd_session;
struct ksmbd_lock {
struct file_lock *fl;
struct ksmbd_conn *conn;
struct list_head clist;
struct list_head flist;
struct list_head llist;