Unverified Commit 67136914 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14348 ksmbd: fix use-after-free in SMB request handling 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yifan Qiao <qiaoyifan4@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/LKNUZJPNBUC3SB37K76ME2GFWSTTF3LS/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBEAF6 
 
Link:https://gitee.com/openeuler/kernel/pulls/14348

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents c2f1662c 90026fa0

fs/smb/server/server.c

+4 −0
Original line number Diff line number Diff line
@@ -276,8 +276,12 @@ static void handle_ksmbd_work(struct work_struct *wk) 
	 * disconnection. waitqueue_active is safe because it

	 * uses atomic operation for condition.

	 */

	atomic_inc(&conn->refcnt);

	if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q))

		wake_up(&conn->r_count_q);



	if (atomic_dec_and_test(&conn->refcnt))

		kfree(conn);

}



/**