FAILED: patch "[PATCH] smb/server: prevent file publication after tree disconnect" failed to apply to 6.6-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 2ff3730998b015b5b0a3f28330bee16c648dd114
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026110452-overfed-reoccur-1b4e@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 2ff3730998b015b5b0a3f28330bee16c648dd114 Mon Sep 17 00:00:00 2001
From: Weiming Shi <[email protected]>
Date: Wed, 21 Oct 2026 07:17:57 -0700
Subject: [PATCH] smb/server: prevent file publication after tree disconnect
TREE_DISCONNECT closes the tree's published file handles before marking and removing the tree connection. A concurrent CREATE that already holds a tree reference can therefore publish its file after the close pass. When CREATE drops its reference, the tree can be freed while the published file still points to it.
Mark and remove the tree connection before closing its files, and serialize both new-open and durable-reconnect volatile ID publication with that state transition. An opener is then either published in time for the close pass or rejected after disconnect with STATUS_NETWORK_NAME_DELETED.
Keep a tree reference while a file carries its tree pointer. This protects asynchronous users that can defer the file's final destruction past tree disconnect.
The close pass can race the successful FP_NEW to FP_INITED transition. Take the opening request's file reference atomically with that transition. This keeps the file alive until request completion even if teardown removes the ID immediately.
BUG: KASAN: slab-use-after-free in proc_show_files (fs/smb/server/vfs_cache.c:126)
Read of size 4 at addr ff11000101540f80 by task poc/153
Call Trace:
proc_show_files (fs/smb/server/vfs_cache.c:126)
seq_read_iter (fs/seq_file.c:231)
proc_reg_read_iter (fs/proc/inode.c:299)
vfs_read (fs/read_write.c:574)
ksys_read (fs/read_write.c:716)
do_syscall_64 (arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)Allocated by:
ksmbd_tree_conn_connect (fs/smb/server/mgmt/tree_connect.c:35)
smb2_tree_connect (fs/smb/server/smb2pdu.c:2819)
handle_ksmbd_work (fs/smb/server/server.c:368)Freed by:
kfree (mm/slub.c:6801)
handle_ksmbd_work (fs/smb/server/server.c:332)fs/smb/server/mgmt/tree_connect.c +7 -0
@@ -103,6 +103,13 @@ ksmbd_tree_conn_connect(struct ksmbd_work *work, const char *share_name)return status; } +struct ksmbd_tree_connect * +ksmbd_tree_connect_get (struct ksmbd_tree_connect *tcon) +{ +atomic_inc (&tcon->refcount); +return tcon; +} +void ksmbd_tree_connect_put (struct ksmbd_tree_connect *tcon) {if (atomic_dec_and_test (&tcon->refcount)) {
fs/smb/server/mgmt/tree_connect.h +2 -0
@@ -51,6 +51,8 @@ struct ksmbd_session;struct ksmbd_tree_conn_status ksmbd_tree_conn_connect (struct ksmbd_work *work,const char *share_name); +struct ksmbd_tree_connect * +ksmbd_tree_connect_get (struct ksmbd_tree_connect *tcon);void ksmbd_tree_connect_put (struct ksmbd_tree_connect *tcon); int ksmbd_tree_conn_disconnect(struct ksmbd_session *sess,
fs/smb/server/smb2pdu.c +29 -8
@@ -3175,9 +3175,10 @@ int smb2_tree_disconnect(struct ksmbd_work *work) goto err_out; } + err =ksmbd_tree_conn_disconnect (sess, tcon); +ksmbd_close_tree_conn_fds (work); - err =ksmbd_tree_conn_disconnect (sess, tcon);if (err) { rsp->hdr.Status =STATUS_NETWORK_NAME_DELETED ; goto err_out;
@@ -4502,8 +4503,12 @@ int smb2_open(struct ksmbd_work *work) goto err_out2; rc =ksmbd_reopen_durable_fd (work, dh_info.fp); -if (rc) +if (rc) { +if (rc == -ENOTCONN ) + rsp->hdr.Status = +STATUS_NETWORK_NAME_DELETED ; goto err_out2; + } fp = dh_info.fp;
@@ -4940,6 +4945,8 @@ int smb2_open(struct ksmbd_work *work)if (IS_ERR (fp)) {fput (filp); rc =PTR_ERR (fp); +if (rc == -ENOTCONN ) + rsp->hdr.Status =STATUS_NETWORK_NAME_DELETED ; fp =NULL ; goto err_out; }
@@ -5544,11 +5551,20 @@ int smb2_open(struct ksmbd_work *work) err_out2:if (!rc) { -if (!dh_info.replay) +if (!dh_info.replay) { +smb2_complete_request_open (work); rc =ksmbd_update_fstate (&work->sess->file_table, fp,FP_INITED ); -if (!rc) +if (rc == -ENOENT ) + rsp->hdr.Status =STATUS_NETWORK_NAME_DELETED ; +if (!rc) { + work->request_open = fp; + work->request_open_chseq = +smb3_hdr_channel_sequence (&req->hdr); + } + }else { rc =smb2_set_request_open (work, fp, &req->hdr, false, false); + }if (!rc) rc =ksmbd_iov_pin_rsp (work, (void *)rsp, iov_len); }
@@ -5563,8 +5579,7 @@ int smb2_open(struct ksmbd_work *work) rsp->hdr.Status =STATUS_PRIVILEGE_NOT_HELD ; else rsp->hdr.Status = STATUS_ACCESS_DENIED; - } -else if (rc == -ENOENT ) + }else if (rc == -ENOENT && !rsp->hdr.Status) rsp->hdr.Status =STATUS_OBJECT_NAME_INVALID ;else if (rc == -EPERM ) rsp->hdr.Status =STATUS_SHARING_VIOLATION ;
@@ -5587,8 +5602,14 @@ int smb2_open(struct ksmbd_work *work)if (!rsp->hdr.Status) rsp->hdr.Status =STATUS_UNEXPECTED_IO_ERROR ; -if (fp && !dh_info.replay) -ksmbd_fd_put (work, fp); +if (fp && !dh_info.replay) { +if (work->request_open == fp) { +ksmbd_close_fd (work, fp->volatile_id); +smb2_complete_request_open (work); + }else { +ksmbd_fd_put (work, fp); + } + }smb2_set_err_rsp (work);ksmbd_debug (SMB ,"Error response: %x\n" , rsp->hdr.Status); }
fs/smb/server/vfs_cache.c +42 -18
145 lines not on this page · raw message