[PATCH 0/3] smb/server: fix some bugs

[PATCH 0/3] smb/server: fix some bugs

[Ze Tan]

Ze Tan (3):
  smb/server: fix tree connection leak in smb2_tree_connect()
  smb/server: check create_proc_sessions() failure
  smb/server: check create_proc_shares() failure

 fs/smb/server/server.c  |  9 +++++++--
 fs/smb/server/smb2pdu.c | 10 +++++++++-
 2 files changed, 16 insertions(+), 3 deletions(-)


base-commit: e7317f3e411724b3e8ba813bb2c09a5c7d381327
-- 
2.43.0

[PATCH 1/3] smb/server: fix tree connection leak in smb2_tree_connect()

[Ze Tan]

See the procedure below:

  smb2_tree_connect
    ksmbd_tree_conn_connect
      xa_store(&sess->tree_conns, tree_conn->id, tree_conn)
      ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)
      ksmbd_share_tree_conn_inc(sc)
    ksmbd_iov_pin_rsp // fail
    status.ret = KSMBD_TREE_CONN_STATUS_NOMEM
    // do not disconnect tree_conn

Disconnect the new tree connection if ksmbd_iov_pin_rsp() fails.

Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound")
Signed-off-by: Ze Tan <tanze@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
 fs/smb/server/smb2pdu.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 835d9e2aacc4..cac83b89535c 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -2691,8 +2691,16 @@ int smb2_tree_connect(struct ksmbd_work *work)
 			cpu_to_le32(SMB2_SHAREFLAG_ACCESS_BASED_DIRECTORY_ENUM);
 
 	rc = ksmbd_iov_pin_rsp(work, rsp, sizeof(struct smb2_tree_connect_rsp));
-	if (rc)
+	if (rc) {
+		if (status.ret == KSMBD_TREE_CONN_STATUS_OK) {
+			down_write(&sess->tree_conns_lock);
+			status.tree_conn->t_state = TREE_DISCONNECTED;
+			up_write(&sess->tree_conns_lock);
+			ksmbd_tree_conn_disconnect(sess, status.tree_conn);
+			status.tree_conn = NULL;
+		}
 		status.ret = KSMBD_TREE_CONN_STATUS_NOMEM;
+	}
 
 	if (!IS_ERR(treename))
 		kfree(treename);
-- 
2.43.0

Re: [PATCH 1/3] smb/server: fix tree connection leak in smb2_tree_connect()

[Namjae Jeon]

On Fri, Aug 14, 2026 at 11:37 AM Ze Tan <tanze@kylinos.cn> wrote:
>
> See the procedure below:
>
>   smb2_tree_connect
>     ksmbd_tree_conn_connect
>       xa_store(&sess->tree_conns, tree_conn->id, tree_conn)
>       ksmbd_counter_inc(KSMBD_COUNTER_TREE_CONNS)
>       ksmbd_share_tree_conn_inc(sc)
>     ksmbd_iov_pin_rsp // fail
>     status.ret = KSMBD_TREE_CONN_STATUS_NOMEM
>     // do not disconnect tree_conn
>
> Disconnect the new tree connection if ksmbd_iov_pin_rsp() fails.
>
> Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound")
> Signed-off-by: Ze Tan <tanze@kylinos.cn>
> Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Applied it to #ksmbd-for-next-next.
Thanks!

[PATCH 2/3] smb/server: check create_proc_sessions() failure

[Ze Tan]

create_proc_sessions() returns -ENOMEM when its procfs entry
cannot be created.

Fixes: b38f99c1217a ("ksmbd: add procfs interface for runtime monitoring and statistics")
Signed-off-by: Ze Tan <tanze@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
 fs/smb/server/server.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 0ccd123ba418..14431adce9b8 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -623,7 +623,10 @@ static int __init ksmbd_server_init(void)
 	ret = ksmbd_proc_init();
 	if (ret)
 		goto err_unregister;
-	create_proc_sessions();
+	ret = create_proc_sessions();
+	if (ret)
+		goto err_proc_cleanup;
+
 	create_proc_shares();
 
 	ksmbd_server_tcp_callbacks_init();
-- 
2.43.0

[PATCH 3/3] smb/server: check create_proc_shares() failure

[Ze Tan]

create_proc_shares() returns -ENOMEM when its procfs entry
cannot be created.

Fixes: b02a77726ed0 ("ksmbd: add procfs monitoring for active shares")
Signed-off-by: Ze Tan <tanze@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
 fs/smb/server/server.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 14431adce9b8..3c318f529927 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -627,7 +627,9 @@ static int __init ksmbd_server_init(void)
 	if (ret)
 		goto err_proc_cleanup;
 
-	create_proc_shares();
+	ret = create_proc_shares();
+	if (ret)
+		goto err_proc_cleanup;
 
 	ksmbd_server_tcp_callbacks_init();
 
-- 
2.43.0

Re: [PATCH 3/3] smb/server: check create_proc_shares() failure

[Namjae Jeon]

> diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
> index 14431adce9b8..3c318f529927 100644
> --- a/fs/smb/server/server.c
> +++ b/fs/smb/server/server.c
> @@ -627,7 +627,9 @@ static int __init ksmbd_server_init(void)
>         if (ret)
>                 goto err_proc_cleanup;
>
> -       create_proc_shares();
> +       ret = create_proc_shares();
> +       if (ret)
> +               goto err_proc_cleanup;
create_proc_sessions() and create_proc_shares() only create optional
procfs monitoring entries. SMB request processing does not depend on
these entries, so a failure should only make the corresponding
monitoring file unavailable.  Do you think we should abort ksmbd
initialization when create_proc_sessions() or create_proc_shares()
fail ?

Re: [PATCH 3/3] smb/server: check create_proc_shares() failure

[ChenXiaoSong]

These two procfs monitoring entries are indeed optional, if their 
creation fails, we should at least print an error message with `pr_err()`.

However, initialization does not happen frequently, would it be better 
to make sure all features are available when initialization completes?

On 8/14/26 13:44, Namjae Jeon wrote:
> Do you think we should abort ksmbd
> initialization when create_proc_sessions() or create_proc_shares()
> fail ?

-- 
ChenXiaoSong <chenxiaosong@chenxiaosong.com>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en

Re: [PATCH 3/3] smb/server: check create_proc_shares() failure

[Namjae Jeon]

On Fri, Aug 14, 2026 at 3:27 PM ChenXiaoSong
<chenxiaosong@chenxiaosong.com> wrote:
>
> These two procfs monitoring entries are indeed optional, if their
> creation fails, we should at least print an error message with `pr_err()`.
>
> However, initialization does not happen frequently, would it be better
> to make sure all features are available when initialization completes?
I think it would be sufficient to just print error message using pr_warn().

>
> On 8/14/26 13:44, Namjae Jeon wrote:
> > Do you think we should abort ksmbd
> > initialization when create_proc_sessions() or create_proc_shares()
> > fail ?
>
> --
> ChenXiaoSong <chenxiaosong@chenxiaosong.com>
> Chinese Homepage: https://chenxiaosong.com
> English Homepage: https://chenxiaosong.com/en
>

Re: [PATCH 3/3] smb/server: check create_proc_shares() failure

[ChenXiaoSong]

Okay, tanze will update the patch, and he will send other fix patches 
together.

On 8/14/26 14:40, Namjae Jeon wrote:
> I think it would be sufficient to just print error message using pr_warn().

-- 
ChenXiaoSong <chenxiaosong@chenxiaosong.com>
Chinese Homepage: https://chenxiaosong.com
English Homepage: https://chenxiaosong.com/en