mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
21a4e47578
Move tcp_transport free to ksmbd_conn_free. If ksmbd connection is referenced when ksmbd server thread terminates, It will not be freed, but conn->tcp_transport is freed. __smb2_lease_break_noti can be performed asynchronously when the connection is disconnected. __smb2_lease_break_noti calls ksmbd_conn_write, which can cause use-after-free when conn->ksmbd_transport is already freed. Cc: stable@vger.kernel.org Reported-by: Norbert Szetei <norbert@doyensec.com> Tested-by: Norbert Szetei <norbert@doyensec.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
15 lines
465 B
C
15 lines
465 B
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* Copyright (C) 2018 Samsung Electronics Co., Ltd.
|
|
*/
|
|
|
|
#ifndef __KSMBD_TRANSPORT_TCP_H__
|
|
#define __KSMBD_TRANSPORT_TCP_H__
|
|
|
|
int ksmbd_tcp_set_interfaces(char *ifc_list, int ifc_list_sz);
|
|
struct interface *ksmbd_find_netdev_name_iface_list(char *netdev_name);
|
|
void ksmbd_free_transport(struct ksmbd_transport *kt);
|
|
int ksmbd_tcp_init(void);
|
|
void ksmbd_tcp_destroy(void);
|
|
|
|
#endif /* __KSMBD_TRANSPORT_TCP_H__ */
|