Namjae Jeon 815f1161d6 ksmbd: fix potential use-after-free in oplock/lease break ack ...

commit 50f930db22 upstream.

If ksmbd_iov_pin_rsp return error, use-after-free can happen by
accessing opinfo->state and opinfo_put and ksmbd_fd_put could
called twice.

Reported-by: Ziyan Xu <research@securitygossip.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-07-17 18:37:24 +02:00

..

mgmt

ksmbd: fix use-after-free in ksmbd_session_rpc_open

2025-05-09 09:50:34 +02:00

asn1.c

ksmbd: use __GFP_RETRY_MAYFAIL

2025-05-02 07:58:56 +02:00

asn1.h

…

auth.c

ksmbd: fix use-after-free in kerberos authentication

2025-05-09 09:50:35 +02:00

auth.h

…

connection.c

ksmbd: add free_transport ops in ksmbd connection

2025-06-27 11:11:42 +01:00

connection.h

ksmbd: provide zero as a unique ID to the Mac client

2025-07-06 11:01:33 +02:00

crypto_ctx.c

ksmbd: use __GFP_RETRY_MAYFAIL

2025-05-02 07:58:56 +02:00

crypto_ctx.h

…

glob.h

ksmbd: use __GFP_RETRY_MAYFAIL

2025-05-02 07:58:56 +02:00

Kconfig

…

ksmbd_netlink.h

ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL

2025-05-02 07:58:57 +02:00

ksmbd_spnego_negtokeninit.asn1

…

ksmbd_spnego_negtokentarg.asn1

…

ksmbd_work.c

ksmbd: use __GFP_RETRY_MAYFAIL

2025-05-02 07:58:56 +02:00

ksmbd_work.h

ksmbd: fix use-after-free in ksmbd_free_work_struct

2025-03-22 12:54:24 -07:00

Makefile

…

misc.c

ksmbd: use __GFP_RETRY_MAYFAIL

2025-05-02 07:58:56 +02:00

misc.h

…

ndr.c

ksmbd: use __GFP_RETRY_MAYFAIL

2025-05-02 07:58:56 +02:00

ndr.h

…

nterr.h

…

ntlmssp.h

…

oplock.c

ksmbd: use list_first_entry_or_null for opinfo_get_list()

2025-06-04 14:43:54 +02:00

oplock.h

ksmbd: fix use-after-free in smb_break_all_levII_oplock()

2025-04-25 10:47:54 +02:00

server.c

ksmbd: use __GFP_RETRY_MAYFAIL

2025-05-02 07:58:56 +02:00

server.h

ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL

2025-05-02 07:58:57 +02:00

smb2misc.c

…

smb2ops.c

…

smb2pdu.c

ksmbd: fix potential use-after-free in oplock/lease break ack

2025-07-17 18:37:24 +02:00

smb2pdu.h

ksmbd: provide zero as a unique ID to the Mac client

2025-07-06 11:01:33 +02:00

smb_common.c

ksmbd: use __GFP_RETRY_MAYFAIL

2025-05-02 07:58:56 +02:00

smb_common.h

…

smbacl.c

ksmbd: use __GFP_RETRY_MAYFAIL

2025-05-02 07:58:56 +02:00

smbacl.h

smb: common: change the data type of num_aces to le16

2025-04-10 14:39:29 +02:00

smbfsctl.h

…

transport_ipc.c

ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL

2025-05-02 07:58:57 +02:00

transport_ipc.h

…

transport_rdma.c

smb: server: make use of rdma_destroy_qp()

2025-07-17 18:37:15 +02:00

transport_rdma.h

…

transport_tcp.c

ksmbd: add free_transport ops in ksmbd connection

2025-06-27 11:11:42 +01:00

transport_tcp.h

ksmbd: fix use-after-free in __smb2_lease_break_noti()

2025-05-02 07:58:57 +02:00

unicode.c

ksmbd: use __GFP_RETRY_MAYFAIL

2025-05-02 07:58:56 +02:00

unicode.h

…

vfs_cache.c

ksmbd: Fix UAF in __close_file_table_ids

2025-05-18 08:24:47 +02:00

vfs_cache.h

…

vfs.c

ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()

2025-07-17 18:37:15 +02:00

vfs.h

…

xattr.h

…