Namjae Jeon b39a1833cc ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency ...

Under high concurrency, A tree-connection object (tcon) is freed on
a disconnect path while another path still holds a reference and later
executes *_put()/write on it.

Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
Reported-by: Zhitong Liu <liuzhitong1993@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

2025-11-30 21:11:45 -06:00

..

ksmbd_ida.c

ksmbd: use __GFP_RETRY_MAYFAIL

2024-11-25 18:58:02 -06:00

ksmbd_ida.h

smb: move client and server files to common directory fs/smb

2023-05-24 16:29:21 -05:00

share_config.c

ksmbd: increase session and share hash table bits

2025-09-30 21:37:55 -05:00

share_config.h

ksmbd: override fsids for share path check

2024-08-08 22:54:09 -05:00

tree_connect.c

ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency

2025-11-30 21:11:45 -06:00

tree_connect.h

ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency

2025-11-30 21:11:45 -06:00

user_config.c

ksmbd: use __GFP_RETRY_MAYFAIL

2024-11-25 18:58:02 -06:00

user_config.h

ksmbd: add support for supplementary groups

2024-10-11 11:02:14 -05:00

user_session.c

ksmbd: fix recursive locking in RPC handle list access

2025-10-15 06:03:09 -05:00

user_session.h

ksmbd: fix use-after-free in ksmbd_session_rpc_open

2025-04-22 20:45:43 -05:00