Namjae Jeon e38ec88a2b ksmbd: fix potential use-after-free in oplock/lease break ack ...

commit 50f930db22 upstream.

If ksmbd_iov_pin_rsp return error, use-after-free can happen by
accessing opinfo->state and opinfo_put and ksmbd_fd_put could
called twice.

Reported-by: Ziyan Xu <research@securitygossip.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-07-17 18:32:15 +02:00

..

mgmt

ksmbd: fix session use-after-free in multichannel connection

2025-04-10 14:33:43 +02:00

asn1.c

…

asn1.h

…

auth.c

ksmbd: fix use-after-free in kerberos authentication

2025-05-09 09:41:36 +02:00

auth.h

…

connection.c

…

connection.h

…

crypto_ctx.c

…

crypto_ctx.h

…

glob.h

…

Kconfig

…

ksmbd_netlink.h

…

ksmbd_spnego_negtokeninit.asn1

…

ksmbd_spnego_negtokentarg.asn1

…

ksmbd_work.c

…

ksmbd_work.h

…

Makefile

…

misc.c

…

misc.h

…

ndr.c

…

ndr.h

…

nterr.h

…

ntlmssp.h

…

oplock.c

ksmbd: fix memory leak in parse_lease_state()

2025-05-18 08:21:21 +02:00

oplock.h

…

server.c

ksmbd: fix racy issue from session lookup and expire

2024-12-19 18:08:48 +01:00

server.h

…

smb2misc.c

ksmbd: fix potencial out-of-bounds when buffer offset is invalid

2024-11-22 15:37:33 +01:00

smb2ops.c

…

smb2pdu.c

ksmbd: fix potential use-after-free in oplock/lease break ack

2025-07-17 18:32:15 +02:00

smb2pdu.h

…

smb_common.c

smb: server: Fix building with GCC 15

2025-01-02 10:30:52 +01:00

smb_common.h

ksmbd: override fsids for share path check

2024-09-18 19:23:02 +02:00

smbacl.c

ksmbd: validate zero num_subauth before sub_auth is accessed

2025-04-10 14:33:43 +02:00

smbacl.h

…

smbfsctl.h

…

smbstatus.h

…

transport_ipc.c

ksmbd: Prevent integer overflow in calculation of deadtime

2025-04-25 10:43:54 +02:00

transport_ipc.h

…

transport_rdma.c

smb: server: make use of rdma_destroy_qp()

2025-07-17 18:32:09 +02:00

transport_rdma.h

…

transport_tcp.c

ksmbd: Unlock on in ksmbd_tcp_set_interfaces()

2024-09-12 11:10:16 +02:00

transport_tcp.h

…

unicode.c

…

unicode.h

…

uniupr.h

…

vfs_cache.c

…

vfs_cache.h

…

vfs.c

ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()

2025-07-17 18:32:09 +02:00

vfs.h

ksmbd: retry iterate_dir in smb2_query_dir

2025-01-09 13:30:04 +01:00

xattr.h

…