This is a note to let you know that I've just added the patch titled
ksmbd: fix uaf in smb20_oplock_break_ack
to the 6.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ksmbd-fix-uaf-in-smb20_oplock_break_ack.patch
and it can be found in the queue-6.5 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From c69813471a1ec081a0b9bf0c6bd7e8afd818afce Mon Sep 17 00:00:00 2001
From: luosili <rootlab@xxxxxxxxxx>
Date: Wed, 4 Oct 2023 18:29:36 +0900
Subject: ksmbd: fix uaf in smb20_oplock_break_ack
From: luosili <rootlab@xxxxxxxxxx>
commit c69813471a1ec081a0b9bf0c6bd7e8afd818afce upstream.
drop reference after use opinfo.
Signed-off-by: luosili <rootlab@xxxxxxxxxx>
Signed-off-by: Namjae Jeon <linkinjeon@xxxxxxxxxx>
Signed-off-by: Steve French <stfrench@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/smb/server/smb2pdu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -8036,10 +8036,10 @@ static void smb20_oplock_break_ack(struc
goto err_out;
}
- opinfo_put(opinfo);
- ksmbd_fd_put(work, fp);
opinfo->op_state = OPLOCK_STATE_NONE;
wake_up_interruptible_all(&opinfo->oplock_q);
+ opinfo_put(opinfo);
+ ksmbd_fd_put(work, fp);
rsp->StructureSize = cpu_to_le16(24);
rsp->OplockLevel = rsp_oplevel;
Patches currently in stable-queue which might be from rootlab@xxxxxxxxxx are
queue-6.5/ksmbd-fix-uaf-in-smb20_oplock_break_ack.patch
queue-6.5/ksmbd-fix-race-condition-from-parallel-smb2-lock-requests.patch
queue-6.5/ksmbd-fix-race-condition-between-session-lookup-and-expire.patch
