From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: gregkh@linuxfoundation.org, linkinjeon@kernel.org,
linux-cifs@vger.kernel.org, samba-technical@lists.samba.org,
Kai Aizen <kai.aizen.dev@gmail.com>
Subject: Re: [PATCH 6.6.y] ksmbd: add chann_lock to protect ksmbd_chann_list xarray
Date: Sun, 3 May 2026 14:17:48 -0400 [thread overview]
Message-ID: <20260503143410.item002-ksmbd-66@kernel.org> (raw)
In-Reply-To: <20260501225152.90136-1-kai.aizen.dev@gmail.com>
On Sat, May 02, 2026 at 01:51:50AM +0300, Kai Aizen wrote:
> From: Namjae Jeon <linkinjeon@kernel.org>
>
> [ Upstream commit 4f3a06cc57976cafa8c6f716646be6c79a99e485 ]
>
> ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in
> multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del).
>
> Adds rw_semaphore chann_lock to struct ksmbd_session and protects
> all xa_load/xa_store/xa_erase accesses.
Thanks for the backport. Unfortunately I'm holding off on queuing this
(and the 6.1.y / 5.15.y siblings) for now.
The backport is faithful to upstream, but on closer review the upstream
commit 4f3a06cc5797 itself does not fully cover the race: there are
xa_for_each() / xa_empty() / xa_load() call sites that remain unprotected
after the patch. Shipping just this commit to the LTS trees would leave
the same UAF window open.
--
Thanks,
Sasha
prev parent reply other threads:[~2026-05-03 18:17 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-01 22:51 [PATCH 6.6.y] ksmbd: add chann_lock to protect ksmbd_chann_list xarray Kai Aizen
2026-05-01 22:51 ` [PATCH 6.1.y] " Kai Aizen
2026-05-01 22:51 ` [PATCH 5.15.y] " Kai Aizen
2026-05-03 18:17 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260503143410.item002-ksmbd-66@kernel.org \
--to=sashal@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=kai.aizen.dev@gmail.com \
--cc=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=samba-technical@lists.samba.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox