Commit d7b1689c authored by Namjae Jeon's avatar Namjae Jeon Committed by Zhong Jinghua
Browse files

ksmbd: limits exceeding the maximum allowable outstanding requests 

mainline inclusion
from mainline-5.17-rc1
commit b589f5db
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I60T7G
CVE: NA

Reference: https://git.kernel.org/torvalds/linux/c/b589f5db6d4a



-------------------------------

If the client ignores the CreditResponse received from the server and
continues to send the request, ksmbd limits the requests if it exceeds
smb2 max credits.

Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
Signed-off-by: default avatarJason Yan <yanaijie@huawei.com>
Signed-off-by: default avatarZhong Jinghua <zhongjinghua@huawei.com>
parent a55dc3cd

fs/ksmbd/connection.c

+1 −0
Original line number Diff line number Diff line
@@ -63,6 +63,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void) 
	atomic_set(&conn->req_running, 0);

	atomic_set(&conn->r_count, 0);

	conn->total_credits = 1;

	conn->outstanding_credits = 1;



	init_waitqueue_head(&conn->req_running_q);

	init_waitqueue_head(&conn->r_count_q);

fs/ksmbd/connection.h

+2 −1
Original line number Diff line number Diff line
@@ -54,7 +54,8 @@ struct ksmbd_conn { 
	atomic_t			req_running;

	/* References which are made for this Server object*/

	atomic_t			r_count;

	unsigned short			total_credits;

	unsigned int			total_credits;

	unsigned int			outstanding_credits;

	spinlock_t			credits_lock;

	wait_queue_head_t		req_running_q;

	wait_queue_head_t		r_count_q;

fs/ksmbd/smb2misc.c

+9 −0
Original line number Diff line number Diff line
@@ -333,7 +333,16 @@ static int smb2_validate_credit_charge(struct ksmbd_conn *conn, 
			    credit_charge, conn->total_credits);

		ret = 1;

	}



	if ((u64)conn->outstanding_credits + credit_charge > conn->vals->max_credits) {

		ksmbd_debug(SMB, "Limits exceeding the maximum allowable outstanding requests, given : %u, pending : %u\n",

			    credit_charge, conn->outstanding_credits);

		ret = 1;

	} else

		conn->outstanding_credits += credit_charge;



	spin_unlock(&conn->credits_lock);



	return ret;

}

fs/ksmbd/smb2pdu.c

+1 −0
Original line number Diff line number Diff line
@@ -323,6 +323,7 @@ int smb2_set_rsp_credits(struct ksmbd_work *work) 
	}



	conn->total_credits -= credit_charge;

	conn->outstanding_credits -= credit_charge;

	credits_requested = max_t(unsigned short,

				  le16_to_cpu(req_hdr->CreditRequest), 1);