[PATCH 0/6] ksmbd: fix some bugs

[PATCH 0/6] ksmbd: fix some bugs

[ZhangGuoDong]

From: ZhangGuoDong <zhangguodong@kylinos.cn>

ZhangGuoDong (6):
  smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
  smb/server: fix memory leak in ksmbd_vfs_set_durable_owner()
  smb/server: fix invalid pointer dereference in
    ksmbd_stop_durable_scavenger()
  smb/server: abort initialization when proc setup fails
  smb/server: call ksmbd_proc_cleanup() on module init failure
  smb/server: preserve error status in smb2_handle_negotiate()

 fs/smb/server/mgmt/share_config.c |  7 ++++++-
 fs/smb/server/misc.h              |  4 ++--
 fs/smb/server/proc.c              | 13 ++++++++-----
 fs/smb/server/server.c            | 10 +++++++---
 fs/smb/server/smb2pdu.c           |  4 ++--
 fs/smb/server/vfs_cache.c         |  9 +++++++--
 6 files changed, 32 insertions(+), 15 deletions(-)

-- 
2.54.0

[PATCH 1/6] smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()

[ZhangGuoDong]

From: ZhangGuoDong <zhangguodong@kylinos.cn>

See the procedure below:

  ksmbd_tree_conn_connect
    ksmbd_share_config_get
      share->name = kstrdup() // fail
      if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) // false
      // do not check `share->name`
    ksmbd_ipc_tree_connect_request
      strlen(share->name) // null-ptr-deref

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
 fs/smb/server/mgmt/share_config.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/mgmt/share_config.c b/fs/smb/server/mgmt/share_config.c
index 1cb58bec0903..53d6f71dd871 100644
--- a/fs/smb/server/mgmt/share_config.c
+++ b/fs/smb/server/mgmt/share_config.c
@@ -215,6 +215,11 @@ static struct ksmbd_share_config *share_config_request(struct ksmbd_work *work,
 	ksmbd_share_tree_conn_init(share);
 	INIT_LIST_HEAD(&share->veto_list);
 	share->name = kstrdup(name, KSMBD_DEFAULT_GFP);
+	if (!share->name) {
+		kill_share(share);
+		share = NULL;
+		goto out;
+	}
 
 	if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) {
 		int path_len = PATH_MAX;
@@ -260,7 +265,7 @@ static struct ksmbd_share_config *share_config_request(struct ksmbd_work *work,
 				share->path = NULL;
 			}
 		}
-		if (ret || !share->name) {
+		if (ret) {
 			kill_share(share);
 			share = NULL;
 			goto out;
-- 
2.54.0

[PATCH 2/6] smb/server: fix memory leak in ksmbd_vfs_set_durable_owner()

[ZhangGuoDong]

From: ZhangGuoDong <zhangguodong@kylinos.cn>

See the procedure below:

  smb2_open
    ksmbd_vfs_set_durable_owner
      fp->owner.name = name

  // When the connection goes away
  ksmbd_sessions_deregister
    ksmbd_session_destroy
      ksmbd_destroy_file_table
        __close_file_table_ids
          session_fd_check // skip()
            ksmbd_vfs_set_durable_owner
              fp->owner.name = name // memory leak

Fixes: 0726814421c2 ("ksmbd: add SMB3 request replay support")
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
 fs/smb/server/vfs_cache.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c
index c28e3d65d64b..5acd06020d42 100644
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -1655,7 +1655,7 @@ void ksmbd_stop_durable_scavenger(void)
 int ksmbd_vfs_set_durable_owner(struct ksmbd_file *fp,
 				struct ksmbd_user *user)
 {
-	char *name;
+	char *name, *old_name;
 
 	if (!user)
 		return -EINVAL;
@@ -1666,10 +1666,12 @@ int ksmbd_vfs_set_durable_owner(struct ksmbd_file *fp,
 		return -ENOMEM;
 
 	spin_lock(&fp->f_lock);
+	old_name = fp->owner.name;
 	fp->owner.uid = user->uid;
 	fp->owner.gid = user->gid;
 	fp->owner.name = name;
 	spin_unlock(&fp->f_lock);
+	kfree(old_name);
 
 	return 0;
 }
-- 
2.54.0

[PATCH 3/6] smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()

[ZhangGuoDong]

From: ZhangGuoDong <zhangguodong@kylinos.cn>

See the procedure below:

  ksmbd_launch_ksmbd_durable_scavenger
    durable_scavenger_running = true
    server_conf.dh_task = kthread_run() // fail, dh_task is an ERR_PTR()

  server_ctrl_handle_reset
    ksmbd_stop_durable_scavenger
    kthread_stop(server_conf.dh_task) // invalid pointer

Fixes: d484d621d40f ("ksmbd: add durable scavenger timer")
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
 fs/smb/server/vfs_cache.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c
index 5acd06020d42..a35df2ab59c9 100644
--- a/fs/smb/server/vfs_cache.c
+++ b/fs/smb/server/vfs_cache.c
@@ -1618,9 +1618,12 @@ void ksmbd_launch_ksmbd_durable_scavenger(void)
 
 	server_conf.dh_task = kthread_run(ksmbd_durable_scavenger,
 				     (void *)NULL, "ksmbd-durable-scavenger");
-	if (IS_ERR(server_conf.dh_task))
+	if (IS_ERR(server_conf.dh_task)) {
 		pr_err("cannot start conn thread, err : %ld\n",
 		       PTR_ERR(server_conf.dh_task));
+		server_conf.dh_task = NULL;
+		durable_scavenger_running = false;
+	}
 	mutex_unlock(&durable_scavenger_lock);
 }
 
-- 
2.54.0

[PATCH 4/6] smb/server: abort initialization when proc setup fails

[ZhangGuoDong]

From: ZhangGuoDong <zhangguodong@kylinos.cn>

ksmbd_server_init() calls ksmbd_proc_init() before creating the
remaining proc entries and server subsystems. ksmbd_proc_init() tears
down partial state on a procfs or percpu_counter allocation failure,
but returns void, so ksmbd_server_init() continues as if the counters
were usable.

Once userspace starts the server, server_ctrl_handle_init() calls
ksmbd_proc_reset(), which reaches percpu_counter_set() with a NULL
per-CPU counters pointer on SMP systems. The later ksmbd_proc_create()
calls also receive a NULL parent and may create entries in the /proc
root; ksmbd_proc_cleanup() cannot remove those entries because
ksmbd_proc_fs is NULL.

Fixes: b38f99c1217a ("ksmbd: add procfs interface for runtime monitoring and statistics")
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
 fs/smb/server/misc.h   |  4 ++--
 fs/smb/server/proc.c   | 13 ++++++++-----
 fs/smb/server/server.c |  4 +++-
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/fs/smb/server/misc.h b/fs/smb/server/misc.h
index 680375a966c5..1faaddd0f5f7 100644
--- a/fs/smb/server/misc.h
+++ b/fs/smb/server/misc.h
@@ -43,7 +43,7 @@ struct ksmbd_const_name {
 	const char *name;
 };
 
-void ksmbd_proc_init(void);
+int ksmbd_proc_init(void);
 void ksmbd_proc_cleanup(void);
 void ksmbd_proc_reset(void);
 struct proc_dir_entry *ksmbd_proc_create(const char *name,
@@ -56,7 +56,7 @@ void ksmbd_proc_show_flag_names(struct seq_file *m,
 const char *ksmbd_proc_const_name(const struct ksmbd_const_name *table,
 				  int count, unsigned int const_value);
 #else
-static inline void ksmbd_proc_init(void) {}
+static inline int ksmbd_proc_init(void) { return 0; }
 static inline void ksmbd_proc_cleanup(void) {}
 static inline void ksmbd_proc_reset(void) {}
 #endif
diff --git a/fs/smb/server/proc.c b/fs/smb/server/proc.c
index 1bf4e00dee34..826353ed0553 100644
--- a/fs/smb/server/proc.c
+++ b/fs/smb/server/proc.c
@@ -239,14 +239,14 @@ void ksmbd_proc_reset(void)
 		percpu_counter_set(&ksmbd_counters.counters[i], 0);
 }
 
-void ksmbd_proc_init(void)
+int ksmbd_proc_init(void)
 {
 	int i;
-	int retval;
+	int retval = -ENOMEM;
 
 	ksmbd_proc_fs = proc_mkdir("fs/ksmbd", NULL);
 	if (!ksmbd_proc_fs)
-		return;
+		return retval;
 
 	if (!proc_mkdir_mode("sessions", 0400, ksmbd_proc_fs))
 		goto err_out;
@@ -257,11 +257,14 @@ void ksmbd_proc_init(void)
 			goto err_out;
 	}
 
-	if (!ksmbd_proc_create("server", proc_show_ksmbd_stats, NULL))
+	if (!ksmbd_proc_create("server", proc_show_ksmbd_stats, NULL)) {
+		retval = -ENOMEM;
 		goto err_out;
+	}
 
 	ksmbd_proc_reset();
-	return;
+	return 0;
 err_out:
 	ksmbd_proc_cleanup();
+	return retval;
 }
diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 18c20a669307..19630ac53235 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -620,7 +620,9 @@ static int __init ksmbd_server_init(void)
 		return ret;
 	}
 
-	ksmbd_proc_init();
+	ret = ksmbd_proc_init();
+	if (ret)
+		goto err_unregister;
 	create_proc_sessions();
 	create_proc_shares();
 
-- 
2.54.0

[PATCH 5/6] smb/server: call ksmbd_proc_cleanup() on module init failure

[ZhangGuoDong]

From: ZhangGuoDong <zhangguodong@kylinos.cn>

When a later initializer fails, the unwind chain releases resources
created after procfs and then jumps directly to class_unregister().
Returning an error from module_init() leaves the proc tree and its
per-CPU counters allocated.

Fixes: b38f99c1217a ("ksmbd: add procfs interface for runtime monitoring and statistics")
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
 fs/smb/server/server.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 19630ac53235..0ccd123ba418 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -630,11 +630,11 @@ static int __init ksmbd_server_init(void)
 
 	ret = server_conf_init();
 	if (ret)
-		goto err_unregister;
+		goto err_proc_cleanup;
 
 	ret = ksmbd_work_pool_init();
 	if (ret)
-		goto err_unregister;
+		goto err_proc_cleanup;
 
 	ret = ksmbd_init_file_cache();
 	if (ret)
@@ -680,6 +680,8 @@ static int __init ksmbd_server_init(void)
 	ksmbd_exit_file_cache();
 err_destroy_work_pools:
 	ksmbd_work_pool_destroy();
+err_proc_cleanup:
+	ksmbd_proc_cleanup();
 err_unregister:
 	class_unregister(&ksmbd_control_class);
 
-- 
2.54.0

[PATCH 6/6] smb/server: preserve error status in smb2_handle_negotiate()

[ZhangGuoDong]

From: ZhangGuoDong <zhangguodong@kylinos.cn>

smb2_handle_negotiate() records specific failures such as
STATUS_INVALID_PARAMETER or STATUS_NOT_SUPPORTED.

Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound")
Signed-off-by: ZhangGuoDong <zhangguodong@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
 fs/smb/server/smb2pdu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 4bde5ab2c881..9b64e28b5d56 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -1722,7 +1722,7 @@ int smb2_handle_negotiate(struct ksmbd_work *work)
 				    KSMBD_DEFAULT_GFP);
 		if (!conn->preauth_info) {
 			rc = -ENOMEM;
-			rsp->hdr.Status = STATUS_INVALID_PARAMETER;
+			rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES;
 			goto err_out;
 		}
 
@@ -1817,7 +1817,7 @@ int smb2_handle_negotiate(struct ksmbd_work *work)
 	ksmbd_conn_set_need_setup(conn);
 
 err_out:
-	if (rc)
+	if (rc && rsp->hdr.Status == STATUS_SUCCESS)
 		rsp->hdr.Status = STATUS_INSUFFICIENT_RESOURCES;
 
 	if (!rc)
-- 
2.54.0

Re: [PATCH 0/6] ksmbd: fix some bugs

[Namjae Jeon]

On Fri, Jul 31, 2026 at 8:56 PM ZhangGuoDong <zhang.guodong@linux.dev> wrote:
>
> From: ZhangGuoDong <zhangguodong@kylinos.cn>
>
> ZhangGuoDong (6):
>   smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
>   smb/server: fix memory leak in ksmbd_vfs_set_durable_owner()
>   smb/server: fix invalid pointer dereference in
>     ksmbd_stop_durable_scavenger()
>   smb/server: abort initialization when proc setup fails
>   smb/server: call ksmbd_proc_cleanup() on module init failure
>   smb/server: preserve error status in smb2_handle_negotiate()
Applied them to #ksmbd-for-next-next.
Thanks!