From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793701048; b=iCdTDIkbdvnPGMUAmDE65XtF7dWjky4QzhsGkKx2HiGZ8ljl3EUf/PbrGUSLp4pnZoaY mZU/l9daAj9feQ0UP8NCmBlMcxT7Scah6dvwrbRU7ej3eFKMnMSETcNCtvheN62zaF8M9 obcMmE59XqB7R2TQXeEvsWPxYgJ8ey7spH9Tl7Po/GSw5tidKN+BwYdDoMmnBZzRnp4Ny E5XCqaTtNAhjMZ4rdN6E3YeUF4miWWzKpfavzcrN5SFLF7nFMusiYxp2cPHd5ZiuMqBFc new31OWUrQIbjoGAoswDB0W02PREFV79P7gBVG7lRejaPV4M8KBKFiw0yHG4bVfLF9w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793701048; h=Received:DKIM-Signature:Subject:To:Cc:From:Date:Message-ID: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=ZkGrXpZPm5qBqEhY22zBCja/9cUs94FfG9EAgn4g9SA=; b=QIMO28oz4VPCjcdO9a0ow//HtTMcIuVYXEbfQWZB2T2JFf2W0wT+FeBY5qznKBeuHuls n+4pwE6UhTxqIvRG8aEmFNWHP6+KpbG0oWcR7AjHHfo91nUheTGQ2tR1NRODMppY2FdWD 3+rS3ty7c/q1K7R9ub5GQzTSKQSOk0uhRFlT1pgeM68TZV3LeFkSaB7ZMefTpB2mygoLW UAnKukkMcfvDwmsVK/onmmDC0wf38CFrj0Z5T3fFrIVxX5AjgYOVPglbQb+FT2cAXyX2A ZkwAN8zEsskY2OOhxvx4aRmXBUb3GIlgAYkDa+9LxjW4dBcXk2AvA1g2jCI/ooUSs9Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="jnp0Z/+M"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E5B9606FAC8 for ; Tue, 3 Nov 2026 10:17:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=jnp0Z/+M Received: by smtp.kernel.org (Postfix) with ESMTPSA id C55E91F00A16; Tue, 3 Nov 2026 10:17:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793701048; bh=ZkGrXpZPm5qBqEhY22zBCja/9cUs94FfG9EAgn4g9SA=; h=Subject:To:Cc:From:Date; b=jnp0Z/+M5aUqM63Vmt7r4Km4hOhlvBC32qvovlc5pK/7m2Ln9CRTgG4HEF3L5mOOM d0u+ctX+Eo8SlkGdzSPN/Kp+/B3TYbIn3IF7c/RBMmVMZ9X2ytRQ5UMlpMFyvmBq9q aW2IMTGOVofxaBqTlNkI1oJYii7ihMClOM9UehDg= Subject: FAILED: patch "[PATCH] ksmbd: fix session reference leak on compounded SESSION_SETUP" failed to apply to 5.15-stable tree To: icb@fastmail.org,linkinjeon@kernel.org Cc: From: Date: Tue, 03 Nov 2026 11:17:20 +0100 Message-ID: <2026110320-crepe-chapter-73d8@gregkh> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 5.15-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y git checkout FETCH_HEAD git cherry-pick -x 03bd8f5279e490e15e0c0f0fa388ffbd2fbacd65 # git commit -s git send-email --to '' --in-reply-to '2026110320-crepe-chapter-73d8@gregkh' --subject-prefix 'PATCH 5.15.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 03bd8f5279e490e15e0c0f0fa388ffbd2fbacd65 Mon Sep 17 00:00:00 2001 From: Ian Bridges Date: Tue, 27 Oct 2026 10:21:35 -0500 Subject: [PATCH] ksmbd: fix session reference leak on compounded SESSION_SETUP A compound request can place SESSION_SETUP after another command. That earlier command leaves a reference to its session in work->sess. smb2_sess_setup() then overwrites work->sess with the session it looks up or creates, and the dispatcher later puts work->sess only once. The inherited reference is never dropped. That leaks the session, together with its setup connection and socket, and every repeat of the compound leaks another. unreferenced object (size 512): __kmalloc_cache_noprof+0x32c/0x3a0 ksmbd_smb2_session_create+0xf6/0x9c0 [ksmbd] smb2_sess_setup+0xda4/0x6280 [ksmbd] handle_ksmbd_work+0x88c/0x1cb0 [ksmbd] Save the inherited session on entry. After the request has been processed, release it once, but only when smb2_sess_setup() has replaced work->sess with its own session or cleared it. Do this after ksmbd_conn_unlock() so the put does not run under srv_mutex. An error path may instead leave the inherited session in work->sess. Keep it there, so the dispatcher still puts it and the error response is still signed or encrypted with it as before. Fixes: 7aa8804c0b67 ("ksmbd: fix user-after-free from session log off") Cc: stable@vger.kernel.org Signed-off-by: Ian Bridges Signed-off-by: Namjae Jeon diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index f4b61521beac..9f2b435fd437 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -2563,6 +2563,8 @@ int smb2_sess_setup(struct ksmbd_work *work) struct smb2_sess_setup_req *req; struct smb2_sess_setup_rsp *rsp; struct ksmbd_session *sess = NULL; + struct ksmbd_session *prev_sess = work->sess; + bool installed = false; struct negotiate_message *negblob; unsigned int negblob_len, negblob_off; u64 previous_session_id = 0; @@ -2679,6 +2681,7 @@ int smb2_sess_setup(struct ksmbd_work *work) int sign_ret; work->sess = sess; + installed = true; if (sess->dialect >= SMB30_PROT_ID) sign_ret = smb3_check_sign_req(work); else @@ -2731,6 +2734,7 @@ int smb2_sess_setup(struct ksmbd_work *work) conn->binding = false; } work->sess = sess; + installed = true; negblob_off = le16_to_cpu(req->SecurityBufferOffset); negblob_len = le16_to_cpu(req->SecurityBufferLength); @@ -2928,6 +2932,14 @@ int smb2_sess_setup(struct ksmbd_work *work) } ksmbd_conn_unlock(conn); + + /* + * Later in a compound, work->sess holds the reference that an + * earlier command took. Drop it once this request has installed + * its own session there or cleared it. + */ + if (prev_sess && (installed || !work->sess)) + ksmbd_user_session_put(prev_sess); return rc; }