Commit 83dcedd5 authored by Namjae Jeon's avatar Namjae Jeon Committed by Steve French
Browse files

ksmbd: fix infinite loop in ksmbd_conn_handler_loop() 



If kernel_recvmsg() return -EAGAIN in ksmbd_tcp_readv() and go round
again, It will cause infinite loop issue. And all threads from next
connections would be doing that. This patch add max retry count(2) to
avoid it. kernel_recvmsg() will wait during 7sec timeout and try to
retry two time if -EAGAIN is returned. And add flags of kvmalloc to
__GFP_NOWARN and __GFP_NORETRY to disconnect immediately without
retrying on memory alloation failure.

Fixes: 0626e664 ("cifsd: add server handler for central processing and tranport layers")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18259
Reviewed-by: default avatarSergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 797805d8

fs/ksmbd/connection.c

+5 −2
Original line number Diff line number Diff line
@@ -316,9 +316,12 @@ int ksmbd_conn_handler_loop(void *p) 


		/* 4 for rfc1002 length field */

		size = pdu_size + 4;

		conn->request_buf = kvmalloc(size, GFP_KERNEL);

		conn->request_buf = kvmalloc(size,

					     GFP_KERNEL |

					     __GFP_NOWARN |

					     __GFP_NORETRY);

		if (!conn->request_buf)

			continue;

			break;



		memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));

		if (!ksmbd_smb_request(conn))

fs/ksmbd/transport_tcp.c

+4 −1
Original line number Diff line number Diff line
@@ -295,6 +295,7 @@ static int ksmbd_tcp_readv(struct tcp_transport *t, struct kvec *iov_orig, 
	struct msghdr ksmbd_msg;

	struct kvec *iov;

	struct ksmbd_conn *conn = KSMBD_TRANS(t)->conn;

	int max_retry = 2;



	iov = get_conn_iovec(t, nr_segs);

	if (!iov)
@@ -321,9 +322,11 @@ static int ksmbd_tcp_readv(struct tcp_transport *t, struct kvec *iov_orig, 
		} else if (conn->status == KSMBD_SESS_NEED_RECONNECT) {

			total_read = -EAGAIN;

			break;

		} else if (length == -ERESTARTSYS || length == -EAGAIN) {

		} else if ((length == -ERESTARTSYS || length == -EAGAIN) &&

			   max_retry) {

			usleep_range(1000, 2000);

			length = 0;

			max_retry--;

			continue;

		} else if (length <= 0) {

			total_read = -EAGAIN;