mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-06 02:50:43 +00:00
17ea92a9f6
There is a report that kernel oops happen from idr_remove(). kernel: BUG: kernel NULL pointer dereference, address: 0000000000000010 kernel: RIP: 0010:idr_remove+0x1/0x20 kernel: __ksmbd_close_fd+0xb2/0x2d0 [ksmbd] kernel: ksmbd_vfs_read+0x91/0x190 [ksmbd] kernel: ksmbd_fd_put+0x29/0x40 [ksmbd] kernel: smb2_read+0x210/0x390 [ksmbd] kernel: __process_request+0xa4/0x180 [ksmbd] kernel: __handle_ksmbd_work+0xf0/0x290 [ksmbd] kernel: handle_ksmbd_work+0x2d/0x50 [ksmbd] kernel: process_one_work+0x21d/0x3f0 kernel: worker_thread+0x50/0x3d0 kernel: rescuer_thread+0x390/0x390 kernel: kthread+0xee/0x120 kthread_complete_and_exit+0x20/0x20 kernel: ret_from_fork+0x22/0x30 While accessing files, If connection is disconnected, windows send session setup request included previous session destroy. But while still processing requests on previous session, this request destroy file table, which mean file table idr will be freed and set to NULL. So kernel oops happen from ft->idr in __ksmbd_close_fd(). This patch don't directly destroy session in destroy_previous_session(). It just set to KSMBD_SESS_EXITING so that connection will be terminated after finishing the rest of requests. Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com> |
||
|---|---|---|
| .. | ||
| mgmt | ||
| asn1.c | ||
| asn1.h | ||
| auth.c | ||
| auth.h | ||
| connection.c | ||
| connection.h | ||
| crypto_ctx.c | ||
| crypto_ctx.h | ||
| glob.h | ||
| Kconfig | ||
| ksmbd_netlink.h | ||
| ksmbd_spnego_negtokeninit.asn1 | ||
| ksmbd_spnego_negtokentarg.asn1 | ||
| ksmbd_work.c | ||
| ksmbd_work.h | ||
| Makefile | ||
| misc.c | ||
| misc.h | ||
| ndr.c | ||
| ndr.h | ||
| nterr.h | ||
| ntlmssp.h | ||
| oplock.c | ||
| oplock.h | ||
| server.c | ||
| server.h | ||
| smb2misc.c | ||
| smb2ops.c | ||
| smb2pdu.c | ||
| smb2pdu.h | ||
| smb_common.c | ||
| smb_common.h | ||
| smbacl.c | ||
| smbacl.h | ||
| smbfsctl.h | ||
| smbstatus.h | ||
| transport_ipc.c | ||
| transport_ipc.h | ||
| transport_rdma.c | ||
| transport_rdma.h | ||
| transport_tcp.c | ||
| transport_tcp.h | ||
| unicode.c | ||
| unicode.h | ||
| uniupr.h | ||
| vfs.c | ||
| vfs.h | ||
| vfs_cache.c | ||
| vfs_cache.h | ||
| xattr.h | ||