From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: DaeMyung Kang <charsyam@gmail.com>,
Namjae Jeon <linkinjeon@kernel.org>,
Steve French <stfrench@microsoft.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.1.y 5/7] ksmbd: destroy async_ida in ksmbd_conn_free()
Date: Thu, 16 Jul 2026 11:37:02 -0400 [thread overview]
Message-ID: <20260716153704.583869-5-sashal@kernel.org> (raw)
In-Reply-To: <20260716153704.583869-1-sashal@kernel.org>
From: DaeMyung Kang <charsyam@gmail.com>
[ Upstream commit b32c8db48212a34998c36d0bbc05b29d5c407ef5 ]
When per-connection async_ida was converted from a dynamically
allocated ksmbd_ida to an embedded struct ida, ksmbd_ida_free() was
removed from the connection teardown path but no matching
ida_destroy() was added. The connection is therefore freed with the
IDA's backing xarray still intact.
The kernel IDA API expects ida_init() and ida_destroy() to be paired
over an object's lifetime, so add the missing cleanup before the
connection is freed.
No leak has been observed in testing; this is a pairing fix to match
the IDA lifetime rules, not a response to a reproduced regression.
Fixes: d40012a83f87 ("cifsd: declare ida statically")
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: c1016dd1d8b2 ("ksmbd: track the connection owning a byte-range lock")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/connection.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c
index ae21de810e5870..2133db6ed80de5 100644
--- a/fs/smb/server/connection.c
+++ b/fs/smb/server/connection.c
@@ -40,6 +40,7 @@ void ksmbd_conn_free(struct ksmbd_conn *conn)
kvfree(conn->request_buf);
kfree(conn->preauth_info);
kfree(conn->mechToken);
+ ida_destroy(&conn->async_ida);
kfree(conn);
}
--
2.53.0
next prev parent reply other threads:[~2026-07-16 15:37 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-14 14:39 FAILED: patch "[PATCH] ksmbd: track the connection owning a byte-range lock" failed to apply to 6.1-stable tree gregkh
2026-07-16 15:36 ` [PATCH 6.1.y 1/7] smb: move some duplicate definitions to common/cifsglob.h Sasha Levin
2026-07-16 15:36 ` [PATCH 6.1.y 2/7] smb: move smb_version_values to common/smbglob.h Sasha Levin
2026-07-16 15:37 ` [PATCH 6.1.y 3/7] ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger Sasha Levin
2026-07-16 15:37 ` [PATCH 6.1.y 4/7] ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc Sasha Levin
2026-07-16 15:37 ` Sasha Levin [this message]
2026-07-16 15:37 ` [PATCH 6.1.y 6/7] ksmbd: centralize ksmbd_conn final release to plug transport leak Sasha Levin
2026-07-16 15:37 ` [PATCH 6.1.y 7/7] ksmbd: track the connection owning a byte-range lock Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260716153704.583869-5-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=charsyam@gmail.com \
--cc=linkinjeon@kernel.org \
--cc=stable@vger.kernel.org \
--cc=stfrench@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox