diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2023-05-03 14:03:40 +0900 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2023-05-03 23:03:02 -0500 |
| commit | abcc506a9a71976a8b4c9bf3ee6efd13229c1e19 (patch) | |
| tree | b1eeedae592e61357661f5dccc4c1c53c10ce58a /fs/ioctl.c | |
| parent | 3353ab2df5f68dab7da8d5ebb427a2d265a1f2b2 (diff) | |
ksmbd: fix racy issue from smb2 close and logoff with multichannel
When smb client send concurrent smb2 close and logoff request
with multichannel connection, It can cause racy issue. logoff request
free tcon and can cause UAF issues in smb2 close. When receiving logoff
request with multichannel, ksmbd should wait until all remaning requests
complete as well as ones in the current connection, and then make
session expired.
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20796 ZDI-CAN-20595
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/ioctl.c')
0 files changed, 0 insertions, 0 deletions