Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'v6.12-rc6-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6
Pull smb client fix from Steve French:
"Fix net namespace refcount use after free issue"
* tag 'v6.12-rc6-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6:
smb: client: Fix use-after-free of network namespace.
+11
-3
+11
-3
fs/smb/client/connect.c
+11
-3
fs/smb/client/connect.c
···
1037
1037
*/
1038
1038
}
1039
1039
1040
+
put_net(cifs_net_ns(server));
1040
1041
kfree(server->leaf_fullpath);
1041
1042
kfree(server);
1042
1043
···
1635
1634
1636
1635
/* srv_count can never go negative */
1637
1636
WARN_ON(server->srv_count < 0);
1638
-
1639
-
put_net(cifs_net_ns(server));
1640
1637
1641
1638
list_del_init(&server->tcp_ses_list);
1642
1639
spin_unlock(&cifs_tcp_ses_lock);
···
3069
3070
if (server->ssocket) {
3070
3071
socket = server->ssocket;
3071
3072
} else {
3072
-
rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM,
3073
+
struct net *net = cifs_net_ns(server);
3074
+
struct sock *sk;
3075
+
3076
+
rc = __sock_create(net, sfamily, SOCK_STREAM,
3073
3077
IPPROTO_TCP, &server->ssocket, 1);
3074
3078
if (rc < 0) {
3075
3079
cifs_server_dbg(VFS, "Error %d creating socket\n", rc);
3076
3080
return rc;
3077
3081
}
3082
+
3083
+
sk = server->ssocket->sk;
3084
+
__netns_tracker_free(net, &sk->ns_tracker, false);
3085
+
sk->sk_net_refcnt = 1;
3086
+
get_net_track(net, &sk->ns_tracker, GFP_KERNEL);
3087
+
sock_inuse_add(net, 1);
3078
3088
3079
3089
/* BB other socket options to set KEEPALIVE, NODELAY? */
3080
3090
cifs_dbg(FYI, "Socket created\n");