* [PATCH] ksmbd: add free_transport ops in ksmbd connection
@ 2025-06-10 10:04 Namjae Jeon
2025-06-17 20:14 ` Stefan Metzmacher
0 siblings, 1 reply; 2+ messages in thread
From: Namjae Jeon @ 2025-06-10 10:04 UTC (permalink / raw)
To: linux-cifs; +Cc: smfrench, senozhatsky, tom, atteh.mailbox, Namjae Jeon
free_transport function for tcp connection can be called from smbdirect.
It will cause kernel oops. This patch add free_transport ops in ksmbd
connection, and add each free_transports for tcp and smbdirect.
Fixes: 21a4e47578d4 ("ksmbd: fix use-after-free in __smb2_lease_break_noti()")
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
---
fs/smb/server/connection.c | 2 +-
fs/smb/server/connection.h | 1 +
fs/smb/server/transport_rdma.c | 10 ++++++++--
fs/smb/server/transport_tcp.c | 3 ++-
4 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c
index 83764c230e9d..3f04a2977ba8 100644
--- a/fs/smb/server/connection.c
+++ b/fs/smb/server/connection.c
@@ -40,7 +40,7 @@ void ksmbd_conn_free(struct ksmbd_conn *conn)
kvfree(conn->request_buf);
kfree(conn->preauth_info);
if (atomic_dec_and_test(&conn->refcnt)) {
- ksmbd_free_transport(conn->transport);
+ conn->transport->ops->free_transport(conn->transport);
kfree(conn);
}
}
diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h
index 6efed923bd68..dd3e0e3f7bf0 100644
--- a/fs/smb/server/connection.h
+++ b/fs/smb/server/connection.h
@@ -133,6 +133,7 @@ struct ksmbd_transport_ops {
void *buf, unsigned int len,
struct smb2_buffer_desc_v1 *desc,
unsigned int desc_len);
+ void (*free_transport)(struct ksmbd_transport *kt);
};
struct ksmbd_transport {
diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 4998df04ab95..64a428a06ace 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -159,7 +159,8 @@ struct smb_direct_transport {
};
#define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
-
+#define SMBD_TRANS(t) ((struct smb_direct_transport *)container_of(t, \
+ struct smb_direct_transport, transport))
enum {
SMB_DIRECT_MSG_NEGOTIATE_REQ = 0,
SMB_DIRECT_MSG_DATA_TRANSFER
@@ -410,6 +411,11 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
return NULL;
}
+static void smb_direct_free_transport(struct ksmbd_transport *kt)
+{
+ kfree(SMBD_TRANS(kt));
+}
+
static void free_transport(struct smb_direct_transport *t)
{
struct smb_direct_recvmsg *recvmsg;
@@ -455,7 +461,6 @@ static void free_transport(struct smb_direct_transport *t)
smb_direct_destroy_pools(t);
ksmbd_conn_free(KSMBD_TRANS(t)->conn);
- kfree(t);
}
static struct smb_direct_sendmsg
@@ -2281,4 +2286,5 @@ static const struct ksmbd_transport_ops ksmbd_smb_direct_transport_ops = {
.read = smb_direct_read,
.rdma_read = smb_direct_rdma_read,
.rdma_write = smb_direct_rdma_write,
+ .free_transport = smb_direct_free_transport,
};
diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c
index abedf510899a..4e9f98db9ff4 100644
--- a/fs/smb/server/transport_tcp.c
+++ b/fs/smb/server/transport_tcp.c
@@ -93,7 +93,7 @@ static struct tcp_transport *alloc_transport(struct socket *client_sk)
return t;
}
-void ksmbd_free_transport(struct ksmbd_transport *kt)
+static void ksmbd_tcp_free_transport(struct ksmbd_transport *kt)
{
struct tcp_transport *t = TCP_TRANS(kt);
@@ -656,4 +656,5 @@ static const struct ksmbd_transport_ops ksmbd_tcp_transport_ops = {
.read = ksmbd_tcp_read,
.writev = ksmbd_tcp_writev,
.disconnect = ksmbd_tcp_disconnect,
+ .free_transport = ksmbd_tcp_free_transport,
};
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ksmbd: add free_transport ops in ksmbd connection
2025-06-10 10:04 [PATCH] ksmbd: add free_transport ops in ksmbd connection Namjae Jeon
@ 2025-06-17 20:14 ` Stefan Metzmacher
0 siblings, 0 replies; 2+ messages in thread
From: Stefan Metzmacher @ 2025-06-17 20:14 UTC (permalink / raw)
To: Namjae Jeon, linux-cifs; +Cc: smfrench, senozhatsky, tom, atteh.mailbox
Am 10.06.25 um 12:04 schrieb Namjae Jeon:
> free_transport function for tcp connection can be called from smbdirect.
> It will cause kernel oops. This patch add free_transport ops in ksmbd
> connection, and add each free_transports for tcp and smbdirect.
>
> Fixes: 21a4e47578d4 ("ksmbd: fix use-after-free in __smb2_lease_break_noti()")
> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
> ---
> fs/smb/server/connection.c | 2 +-
> fs/smb/server/connection.h | 1 +
> fs/smb/server/transport_rdma.c | 10 ++++++++--
> fs/smb/server/transport_tcp.c | 3 ++-
> 4 files changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c
> index 83764c230e9d..3f04a2977ba8 100644
> --- a/fs/smb/server/connection.c
> +++ b/fs/smb/server/connection.c
> @@ -40,7 +40,7 @@ void ksmbd_conn_free(struct ksmbd_conn *conn)
> kvfree(conn->request_buf);
> kfree(conn->preauth_info);
> if (atomic_dec_and_test(&conn->refcnt)) {
> - ksmbd_free_transport(conn->transport);
> + conn->transport->ops->free_transport(conn->transport);
> kfree(conn);
> }
> }
> diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h
> index 6efed923bd68..dd3e0e3f7bf0 100644
> --- a/fs/smb/server/connection.h
> +++ b/fs/smb/server/connection.h
> @@ -133,6 +133,7 @@ struct ksmbd_transport_ops {
> void *buf, unsigned int len,
> struct smb2_buffer_desc_v1 *desc,
> unsigned int desc_len);
> + void (*free_transport)(struct ksmbd_transport *kt);
> };
>
> struct ksmbd_transport {
> diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
> index 4998df04ab95..64a428a06ace 100644
> --- a/fs/smb/server/transport_rdma.c
> +++ b/fs/smb/server/transport_rdma.c
> @@ -159,7 +159,8 @@ struct smb_direct_transport {
> };
>
> #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
> -
> +#define SMBD_TRANS(t) ((struct smb_direct_transport *)container_of(t, \
> + struct smb_direct_transport, transport))
> enum {
> SMB_DIRECT_MSG_NEGOTIATE_REQ = 0,
> SMB_DIRECT_MSG_DATA_TRANSFER
> @@ -410,6 +411,11 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
> return NULL;
> }
>
> +static void smb_direct_free_transport(struct ksmbd_transport *kt)
> +{
> + kfree(SMBD_TRANS(kt));
> +}
> +
> static void free_transport(struct smb_direct_transport *t)
> {
> struct smb_direct_recvmsg *recvmsg;
> @@ -455,7 +461,6 @@ static void free_transport(struct smb_direct_transport *t)
>
> smb_direct_destroy_pools(t);
> ksmbd_conn_free(KSMBD_TRANS(t)->conn);
> - kfree(t);
> }
>
> static struct smb_direct_sendmsg
> @@ -2281,4 +2286,5 @@ static const struct ksmbd_transport_ops ksmbd_smb_direct_transport_ops = {
> .read = smb_direct_read,
> .rdma_read = smb_direct_rdma_read,
> .rdma_write = smb_direct_rdma_write,
> + .free_transport = smb_direct_free_transport,
> };
> diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c
> index abedf510899a..4e9f98db9ff4 100644
> --- a/fs/smb/server/transport_tcp.c
> +++ b/fs/smb/server/transport_tcp.c
> @@ -93,7 +93,7 @@ static struct tcp_transport *alloc_transport(struct socket *client_sk)
> return t;
> }
>
> -void ksmbd_free_transport(struct ksmbd_transport *kt)
> +static void ksmbd_tcp_free_transport(struct ksmbd_transport *kt)
> {
> struct tcp_transport *t = TCP_TRANS(kt);
>
> @@ -656,4 +656,5 @@ static const struct ksmbd_transport_ops ksmbd_tcp_transport_ops = {
> .read = ksmbd_tcp_read,
> .writev = ksmbd_tcp_writev,
> .disconnect = ksmbd_tcp_disconnect,
> + .free_transport = ksmbd_tcp_free_transport,
> };
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-06-17 20:25 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-06-10 10:04 [PATCH] ksmbd: add free_transport ops in ksmbd connection Namjae Jeon
2025-06-17 20:14 ` Stefan Metzmacher
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox