dummy/linux-stable-mirror
1
0
Fork 1
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2025-04-19 20:58:31 +09:00
Code Issues Packages Projects Releases Wiki Activity

Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"

Browse Source 
This reverts commit 4e7f1644f2ac6d01dc584f6301c3b1d5aac4eaef.

The commit e9f2517a3e18 ("smb: client: fix TCP timers deadlock after
rmmod") is not only a bogus fix for LOCKDEP null-ptr-deref but also
introduces a real issue, TCP sockets leak, which will be explained in
detail in the next revert.

Also, CNA assigned CVE-2024-54680 to it but is rejecting it. [0]

Thus, we are reverting the commit and its follow-up commit 4e7f1644f2ac
("smb: client: Fix netns refcount imbalance causing leaks and
use-after-free").

Link: https://lore.kernel.org/all/2025040248-tummy-smilingly-4240@gregkh/ #[0]
Fixes: 4e7f1644f2ac ("smb: client: Fix netns refcount imbalance causing leaks and use-after-free")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Kuniyuki Iwashima 2025-04-02 13:26:47 -07:00 committed by Steve French
parent 262b73ef44
commit c707193a17
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
fs/smb/client/connect.c
View File

@ -300,7 +300,6 @@ cifs_abort_connection(struct TCP_Server_Info *server)
server->ssocket->flags);
sock_release(server->ssocket);
server->ssocket = NULL;
put_net(cifs_net_ns(server));
}
server->sequence_number = 0;
server->session_estab = false;
@ -3369,12 +3368,8 @@ generic_ip_connect(struct TCP_Server_Info *server)
/*
* Grab netns reference for the socket.
*
* This reference will be released in several situations:
* - In the failure path before the cifsd thread is started.
* - In the all place where server->socket is released, it is
* also set to NULL.
* - Ultimately in clean_demultiplex_info(), during the final
* teardown.
* It'll be released here, on error, or in clean_demultiplex_info() upon server
* teardown.
*/
get_net(net);
@ -3390,8 +3385,10 @@ generic_ip_connect(struct TCP_Server_Info *server)
}
rc = bind_socket(server);
if (rc < 0)
if (rc < 0) {
put_net(cifs_net_ns(server));
return rc;
}
/*
* Eventually check for other socket options to change from
@ -3446,6 +3443,9 @@ generic_ip_connect(struct TCP_Server_Info *server)
(server->rfc1001_sessinit == -1 && sport == htons(RFC1001_PORT)))
rc = ip_rfc1001_connect(server);
if (rc < 0)
put_net(cifs_net_ns(server));
return rc;
}