FAILED: patch "[PATCH] ksmbd: track the connection owning a byte-range lock" failed to apply to 6.12-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026071413-detection-unexposed-321e@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb Mon Sep 17 00:00:00 2001
From: Namjae Jeon <[email protected]>
Date: Mon, 15 Jun 2026 10:00:00 +0900
Subject: [PATCH] ksmbd: track the connection owning a byte-range lock
SMB2_LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths, however, remove the connection list entry while holding fp->conn->llist_lock.
With SMB3 multichannel, the connection handling the LOCK request can be different from the connection which opened the file. The entry can therefore be removed under a different spinlock from the one protecting the list it belongs to. A concurrent traversal can then access freed struct ksmbd_lock and struct file_lock objects.
Record the connection owning each lock's clist entry and hold a reference to it while the entry is linked. Use that connection and its llist_lock for unlock, rollback, close, and durable preserve. Durable reconnect assigns the new connection as the owner when publishing the locks again.
fs/smb/server/smb2pdu.c +8 -2
@@ -7774,9 +7774,11 @@ int smb2_lock(struct ksmbd_work *work) nolock =0 ;list_del (&cmp_lock->flist);list_del (&cmp_lock->clist); + cmp_lock->conn =NULL ;spin_unlock (&conn->llist_lock);up_read (&conn_list_lock); +ksmbd_conn_put (conn);locks_free_lock (cmp_lock->fl);kfree (cmp_lock); goto out_check_cl;
@@ -7911,6 +7913,7 @@ int smb2_lock(struct ksmbd_work *work) goto out2; }else if (!rc) {list_add (&smb_lock->llist, &rollback_list); + smb_lock->conn =ksmbd_conn_get (work->conn);spin_lock (&work->conn->llist_lock);list_add_tail (&smb_lock->clist, &work->conn->lock_list);
@@ -7965,11 +7968,14 @@ int smb2_lock(struct ksmbd_work *work) }list_del (&smb_lock->llist); -spin_lock (&work->conn->llist_lock); + conn = smb_lock->conn; +spin_lock (&conn->llist_lock);if (!list_empty (&smb_lock->flist))list_del (&smb_lock->flist);list_del (&smb_lock->clist); -spin_unlock (&work->conn->llist_lock); + smb_lock->conn =NULL ; +spin_unlock (&conn->llist_lock); +ksmbd_conn_put (conn);locks_free_lock (smb_lock->fl);if (rlock)
fs/smb/server/vfs_cache.c +17 -6
@@ -484,10 +484,14 @@ static void __ksmbd_close_fd(struct ksmbd_file_table *ft, struct ksmbd_file *fp)* there are not accesses to fp->lock_list. */ list_for_each_entry_safe (smb_lock, tmp_lock, &fp->lock_list, flist) { -if (!list_empty (&smb_lock->clist) && fp->conn) { -spin_lock (&fp->conn->llist_lock); -list_del (&smb_lock->clist); -spin_unlock (&fp->conn->llist_lock); +struct ksmbd_conn *conn = smb_lock->conn; + +if (conn) { +spin_lock (&conn->llist_lock); +list_del_init (&smb_lock->clist); + smb_lock->conn =NULL ; +spin_unlock (&conn->llist_lock); +ksmbd_conn_put (conn); }list_del (&smb_lock->flist);
@@ -1303,9 +1307,15 @@ static bool session_fd_check(struct ksmbd_tree_connect *tcon,up_write (&ci->m_lock);list_for_each_entry_safe (smb_lock, tmp_lock, &fp->lock_list, flist) { -spin_lock (&conn->llist_lock); +struct ksmbd_conn *lock_conn = smb_lock->conn; + +if (!lock_conn) +continue ; +spin_lock (&lock_conn->llist_lock);list_del_init (&smb_lock->clist); -spin_unlock (&conn->llist_lock); + smb_lock->conn =NULL ; +spin_unlock (&lock_conn->llist_lock); +ksmbd_conn_put (lock_conn); } fp->conn =NULL ;
@@ -1435,6 +1445,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp) }list_for_each_entry (smb_lock, &fp->lock_list, flist) { + smb_lock->conn =ksmbd_conn_get (conn);spin_lock (&conn->llist_lock);list_add_tail (&smb_lock->clist, &conn->lock_list);spin_unlock (&conn->llist_lock);
fs/smb/server/vfs_cache.h +1 -0
@@ -32,6 +32,7 @@ struct ksmbd_session;struct ksmbd_lock {struct file_lock *fl; +struct ksmbd_conn *conn;struct list_head clist;struct list_head flist;struct list_head llist;
Sasha Levin
maintainerPATCH 1/2 ksmbd: centralize ksmbd_conn final release to plug transport leak
From: DaeMyung Kang <[email protected]>
[ Upstream commit b1f1e80620deb49daf63c2e677046599b693dc1f ]
ksmbd_conn_free() is one of four sites that can observe the last refcount drop of a struct ksmbd_conn. The other three
fs/smb/server/connection.c ksmbd_conn_r_count_dec()
fs/smb/server/oplock.c __free_opinfo()
fs/smb/server/vfs_cache.c session_fd_check()end the conn with a bare kfree(), skipping ida_destroy(&conn->async_ida) and conn->transport->ops->free_transport(conn->transport). Whenever one of them is the last putter, the embedded async_ida and the entire transport struct leak -- for TCP, that is also the struct socket and the kvec iov.
__free_opinfo() being a final putter is not theoretical. opinfo_put() queues the callback via call_rcu(&opinfo->rcu, free_opinfo_rcu), so ksmbd_server_terminate_conn() can deposit N opinfo releases in RCU and have ksmbd_conn_free() run in the handler thread before any of them fire. ksmbd_conn_free() then observes refcnt > 0 and short-circuits; the last RCU-delivered __free_opinfo() falls onto its bare kfree(conn) branch and the transport is lost.
A/B validation in a QEMU/virtme guest, mounting //127.0.0.1/testshare:
each iteration holds 8 files open via sleep processes, force-closes TCP with "ss -K sport = :445", kills the holders, lazy-umounts; repeated 10 times, then ksmbd shutdown and kmemleak scan.
state conn_alloc conn_free tcp_free opi_rcu kmemleak
---------- ---------- --------- -------- ------- --------
pre-patch 20 20 10 160 7
with patch 20 20 20 160 0Pre-patch conn_free=20 with tcp_free=10 directly demonstrates the bare-kfree paths skipping transport cleanup; kmemleak backtraces point into struct tcp_transport / iov. With this patch tcp_free matches conn_free at 20/20 and kmemleak is clean.
Move the per-struct final release into __ksmbd_conn_release_work() and route the three bare-kfree final-put sites through a new ksmbd_conn_put(). Those sites now pair ida_destroy() and free_transport() with kfree(conn) regardless of which holder happens to release the last reference. stop_sessions() only triggers the transport shutdown and does not itself drop the last conn reference, so it is unaffected.
The centralized release reaches sock_release() -> tcp_close() -> lock_sock_nested() (might_sleep) from every final putter, including __free_opinfo() invoked from an RCU softirq callback, which trips CONFIG_DEBUG_ATOMIC_SLEEP. Defer the release to a dedicated ksmbd_conn_wq workqueue so ksmbd_conn_put() is safe from any non-sleeping context.
Make ksmbd_file own a strong connection reference while fp->conn is non-NULL so durable-preserve and final-close paths cannot dereference a stale connection. ksmbd_open_fd() and ksmbd_reopen_durable_fd() take the reference via ksmbd_conn_get() (the latter also reorders the fp->conn / fp->tcon assignments before __open_id() so the published fp is never observed with fp->conn == NULL); session_fd_check() and __ksmbd_close_fd() drop it via ksmbd_conn_put(). With that invariant, session_fd_check() can take a local conn pointer once and use it across the m_op_list and lock_list iterations even though op->conn puts may otherwise drop the last reference.
At module exit the workqueue is flushed and destroyed after rcu_barrier(), so any release queued by a trailing RCU callback is drained before the inode hash and module text go away.
Stable-dep-of: c1016dd1d8b2 ("ksmbd: track the connection owning a byte-range lock")
--- fs/smb/server/connection.c | 101 +++++++++++++++++++++++++++++++------ fs/smb/server/connection.h | 6 +++ fs/smb/server/oplock.c | 7 +-- fs/smb/server/server.c | 12 +++++ fs/smb/server/vfs_cache.c | 60 ++++++++++++++++++---- 5 files changed, 156 insertions(+), 30 deletions(-)
fs/smb/server/connection.c +86 -15
@@ -22,6 +22,81 @@ static struct ksmbd_conn_ops default_conn_ops;DEFINE_HASHTABLE (conn_list,CONN_HASH_BITS );DECLARE_RWSEM (conn_list_lock); +static struct workqueue_struct *ksmbd_conn_wq; + +int ksmbd_conn_wq_init (void ) +{ + ksmbd_conn_wq =alloc_workqueue ("ksmbd-conn-release" , +WQ_UNBOUND |WQ_MEM_RECLAIM ,0 ); +if (!ksmbd_conn_wq) +return -ENOMEM ; +return 0 ; +} + +void ksmbd_conn_wq_destroy (void ) +{ +if (ksmbd_conn_wq) { +destroy_workqueue (ksmbd_conn_wq); + ksmbd_conn_wq =NULL ; + } +} + +/* +* __ksmbd_conn_release_work() - perform the final, once-per-struct cleanup +* of a ksmbd_conn whose refcount has just dropped to zero. +* +* This is the common release path used by ksmbd_conn_put() for the embedded +* state that outlives the connection thread: async_ida and the attached +* transport (which owns the socket and iov for TCP). Called from a workqueue +* so that sleep-allowed teardown (sock_release -> tcp_close -> +* lock_sock_nested) never runs from an RCU softirq callback (free_opinfo_rcu) +* or any other non-sleeping putter context. +*/ +static void __ksmbd_conn_release_work (struct work_struct *work) +{ +struct ksmbd_conn *conn = + container_of(work, struct ksmbd_conn, release_work); + +ida_destroy (&conn->async_ida); + conn->transport->ops->free_transport (conn->transport); +kfree (conn); +} + +/** +* ksmbd_conn_get() - take a reference on @conn and return it. +* +* Returns @conn unchanged so callers can write +* "fp->conn = ksmbd_conn_get(work->conn);" in one expression. Returns NULL +* if @conn is NULL. +*/ +struct ksmbd_conn *ksmbd_conn_get (struct ksmbd_conn *conn) +{ +if (!conn) +return NULL ; + +atomic_inc (&conn->refcnt); +return conn; +} + +/** +* ksmbd_conn_put() - drop a reference and, if it was the last, queue the +* release onto ksmbd_conn_wq so it runs from process context. +* +* Callable from any context including RCU softirq callbacks and non-sleeping +* locks; the actual release is deferred to the workqueue. ksmbd_conn_wq is +* created in ksmbd_server_init() before any conn can be allocated and is +* destroyed in ksmbd_server_exit() after rcu_barrier(), so it is always +* non-NULL while a conn reference is held. +*/ +void ksmbd_conn_put (struct ksmbd_conn *conn) +{ +if (!conn) +return ; + +if (atomic_dec_and_test (&conn->refcnt)) +queue_work (ksmbd_conn_wq, &conn->release_work); +} +/** * ksmbd_conn_free() - free resources of the connection instance *
@@ -36,23 +111,19 @@ void ksmbd_conn_free(struct ksmbd_conn *conn)hash_del (&conn->hlist);up_write (&conn_list_lock); +/* +* request_buf / preauth_info / mechToken are only ever accessed by the +* connection handler thread that owns @conn. ksmbd_conn_free() is +* called from the transport free_transport() path when that thread is +* exiting, so it is safe to release them unconditionally even when +* ksmbd_conn_put() below is not the final putter (oplock / ksmbd_file +* holders only retain the conn pointer, not these per-thread buffers). +*/ xa_destroy (&conn->sessions);kvfree (conn->request_buf);kfree (conn->preauth_info);kfree (conn->mechToken); -if (atomic_dec_and_test (&conn->refcnt)) { -/* -* async_ida is embedded in struct ksmbd_conn, so pair -* ida_destroy() with the final kfree() rather than with -* the unconditional field teardown above. This keeps -* the IDA valid for the entire lifetime of the struct, -* even while other refcount holders (oplock / vfs -* durable handles) still reference the connection. -*/ -ida_destroy (&conn->async_ida); - conn->transport->ops->free_transport (conn->transport); -kfree (conn); - } +ksmbd_conn_put (conn); }/**
@@ -79,6 +150,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void) conn->um =ERR_PTR (-EOPNOTSUPP );if (IS_ERR (conn->um)) conn->um =NULL ; +INIT_WORK (&conn->release_work, __ksmbd_conn_release_work);atomic_set (&conn->req_running,0 );atomic_set (&conn->r_count,0 );atomic_set (&conn->refcnt,1 );
@@ -457,8 +529,7 @@ void ksmbd_conn_r_count_dec(struct ksmbd_conn *conn)if (!atomic_dec_return (&conn->r_count) &&waitqueue_active (&conn->r_count_q))wake_up (&conn->r_count_q); -if (atomic_dec_and_test (&conn->refcnt)) -kfree (conn); +ksmbd_conn_put (conn); }int ksmbd_conn_transport_init (void )
fs/smb/server/connection.h +6 -0
@@ -15,6 +15,7 @@#include <linux/kthread.h> #include <linux/nls.h> #include <linux/unicode.h> +#include <linux/workqueue.h> #include "smb_common.h" #include "ksmbd_work.h"
@@ -117,6 +118,7 @@ struct ksmbd_conn {bool binding;atomic_t refcnt;bool is_aapl; +struct work_struct release_work; };struct ksmbd_conn_ops {
@@ -162,6 +164,10 @@ void ksmbd_conn_wait_idle(struct ksmbd_conn *conn);int ksmbd_conn_wait_idle_sess_id (struct ksmbd_conn *curr_conn,u64 sess_id);struct ksmbd_conn *ksmbd_conn_alloc (void );void ksmbd_conn_free (struct ksmbd_conn *conn); +struct ksmbd_conn *ksmbd_conn_get (struct ksmbd_conn *conn); +void ksmbd_conn_put (struct ksmbd_conn *conn); +int ksmbd_conn_wq_init (void ); +void ksmbd_conn_wq_destroy (void );bool ksmbd_conn_lookup_dialect (struct ksmbd_conn *c);int ksmbd_conn_write (struct ksmbd_work *work); int ksmbd_conn_rdma_read(struct ksmbd_conn *conn,
fs/smb/server/oplock.c +2 -5
@@ -30,7 +30,6 @@ static DEFINE_RWLOCK(lease_list_lock);static struct oplock_info *alloc_opinfo (struct ksmbd_work *work,u64 id,__u16 Tid) { -struct ksmbd_conn *conn = work->conn;struct ksmbd_session *sess = work->sess;struct oplock_info *opinfo;
@@ -39,7 +38,7 @@ static struct oplock_info *alloc_opinfo(struct ksmbd_work *work,return NULL ; opinfo->sess = sess; - opinfo->conn = conn; + opinfo->conn =ksmbd_conn_get (work->conn); opinfo->level =SMB2_OPLOCK_LEVEL_NONE ; opinfo->op_state =OPLOCK_STATE_NONE ; opinfo->pending_break =0 ;
@@ -50,7 +49,6 @@ static struct oplock_info *alloc_opinfo(struct ksmbd_work *work,init_waitqueue_head (&opinfo->oplock_brk);atomic_set (&opinfo->refcount,1 );atomic_set (&opinfo->breaking_cnt,0 ); -atomic_inc (&opinfo->conn->refcnt);return opinfo; }
@@ -132,8 +130,7 @@ static void __free_opinfo(struct oplock_info *opinfo) {if (opinfo->is_lease)free_lease (opinfo); -if (opinfo->conn &&atomic_dec_and_test (&opinfo->conn->refcnt)) -kfree (opinfo->conn); +ksmbd_conn_put (opinfo->conn);kfree (opinfo); }
fs/smb/server/server.c +12 -0
@@ -587,8 +587,14 @@ static int __init ksmbd_server_init(void)if (ret) goto err_crypto_destroy; + ret =ksmbd_conn_wq_init (); +if (ret) + goto err_workqueue_destroy; +return 0 ; +err_workqueue_destroy: +ksmbd_workqueue_destroy (); err_crypto_destroy:ksmbd_crypto_destroy (); err_release_inode_hash:
@@ -614,6 +620,12 @@ static void __exit ksmbd_server_exit(void) {ksmbd_server_shutdown ();rcu_barrier (); +/* +* ksmbd_conn_put() defers the final release onto ksmbd_conn_wq, +* so drain it after rcu_barrier() has fired any pending RCU +* callbacks that may have queued a release. +*/ +ksmbd_conn_wq_destroy ();ksmbd_release_inode_hash (); }
fs/smb/server/vfs_cache.c +50 -10
123 lines not on this page · raw message
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/2 ksmbd: track the connection owning a byte-range lock
From: Namjae Jeon <[email protected]>
[ Upstream commit c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb ]
SMB2_LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths, however, remove the connection list entry while holding fp->conn->llist_lock.
With SMB3 multichannel, the connection handling the LOCK request can be different from the connection which opened the file. The entry can therefore be removed under a different spinlock from the one protecting the list it belongs to. A concurrent traversal can then access freed struct ksmbd_lock and struct file_lock objects.
Record the connection owning each lock's clist entry and hold a reference to it while the entry is linked. Use that connection and its llist_lock for unlock, rollback, close, and durable preserve. Durable reconnect assigns the new connection as the owner when publishing the locks again.
--- fs/smb/server/smb2pdu.c | 10 ++++++++-- fs/smb/server/vfs_cache.c | 23 +++++++++++++++++------ fs/smb/server/vfs_cache.h | 1 + 3 files changed, 26 insertions(+), 8 deletions(-)
fs/smb/server/smb2pdu.c +8 -2
@@ -7571,9 +7571,11 @@ int smb2_lock(struct ksmbd_work *work) nolock =0 ;list_del (&cmp_lock->flist);list_del (&cmp_lock->clist); + cmp_lock->conn =NULL ;spin_unlock (&conn->llist_lock);up_read (&conn_list_lock); +ksmbd_conn_put (conn);locks_free_lock (cmp_lock->fl);kfree (cmp_lock); goto out_check_cl;
@@ -7710,6 +7712,7 @@ int smb2_lock(struct ksmbd_work *work) goto retry; }else if (!rc) {list_add (&smb_lock->llist, &rollback_list); + smb_lock->conn =ksmbd_conn_get (work->conn);spin_lock (&work->conn->llist_lock);list_add_tail (&smb_lock->clist, &work->conn->lock_list);
@@ -7764,11 +7767,14 @@ int smb2_lock(struct ksmbd_work *work) }list_del (&smb_lock->llist); -spin_lock (&work->conn->llist_lock); + conn = smb_lock->conn; +spin_lock (&conn->llist_lock);if (!list_empty (&smb_lock->flist))list_del (&smb_lock->flist);list_del (&smb_lock->clist); -spin_unlock (&work->conn->llist_lock); + smb_lock->conn =NULL ; +spin_unlock (&conn->llist_lock); +ksmbd_conn_put (conn);locks_free_lock (smb_lock->fl);if (rlock)
fs/smb/server/vfs_cache.c +17 -6
@@ -387,10 +387,14 @@ static void __ksmbd_close_fd(struct ksmbd_file_table *ft, struct ksmbd_file *fp)* there are not accesses to fp->lock_list. */ list_for_each_entry_safe (smb_lock, tmp_lock, &fp->lock_list, flist) { -if (!list_empty (&smb_lock->clist) && fp->conn) { -spin_lock (&fp->conn->llist_lock); -list_del (&smb_lock->clist); -spin_unlock (&fp->conn->llist_lock); +struct ksmbd_conn *conn = smb_lock->conn; + +if (conn) { +spin_lock (&conn->llist_lock); +list_del_init (&smb_lock->clist); + smb_lock->conn =NULL ; +spin_unlock (&conn->llist_lock); +ksmbd_conn_put (conn); }list_del (&smb_lock->flist);
@@ -1070,9 +1074,15 @@ static bool session_fd_check(struct ksmbd_tree_connect *tcon,up_write (&ci->m_lock);list_for_each_entry_safe (smb_lock, tmp_lock, &fp->lock_list, flist) { -spin_lock (&conn->llist_lock); +struct ksmbd_conn *lock_conn = smb_lock->conn; + +if (!lock_conn) +continue ; +spin_lock (&lock_conn->llist_lock);list_del_init (&smb_lock->clist); -spin_unlock (&conn->llist_lock); + smb_lock->conn =NULL ; +spin_unlock (&lock_conn->llist_lock); +ksmbd_conn_put (lock_conn); } fp->conn =NULL ;
@@ -1193,6 +1203,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp) }list_for_each_entry (smb_lock, &fp->lock_list, flist) { + smb_lock->conn =ksmbd_conn_get (conn);spin_lock (&conn->llist_lock);list_add_tail (&smb_lock->clist, &conn->lock_list);spin_unlock (&conn->llist_lock);
fs/smb/server/vfs_cache.h +1 -0
@@ -31,6 +31,7 @@ struct ksmbd_session;struct ksmbd_lock {struct file_lock *fl; +struct ksmbd_conn *conn;struct list_head clist;struct list_head flist;struct list_head llist;
Signature · 1 line
2.53.0