ksmbd: fix infinite loop in ksmbd_conn_handler_loop()
mainline inclusion from mainline-v6.2-rc4 commit 83dcedd5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I74FNG CVE: CVE-2023-2593 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=83dcedd5540d4ac61376ddff5362f7d9f866a6ec -------------------------------- If kernel_recvmsg() return -EAGAIN in ksmbd_tcp_readv() and go round again, It will cause infinite loop issue. And all threads from next connections would be doing that. This patch add max retry count(2) to avoid it. kernel_recvmsg() will wait during 7sec timeout and try to retry two time if -EAGAIN is returned. And add flags of kvmalloc to __GFP_NOWARN and __GFP_NORETRY to disconnect immediately without retrying on memory alloation failure. Fixes: 0626e664 ("cifsd: add server handler for central processing and tranport layers") Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18259 Reviewed-by:Sergey Senozhatsky <senozhatsky@chromium.org> Signed-off-by:
Namjae Jeon <linkinjeon@kernel.org> Signed-off-by:
Steve French <stfrench@microsoft.com> Signed-off-by:
ZhaoLong Wang <wangzhaolong1@huawei.com> Conflicts: fs/ksmbd/connection.c fs/ksmbd/transport_tcp.c
Loading
Please sign in to comment