Namjae Jeon 97c3559899 ksmbd: fix potential use-after-free in oplock/lease break ack ... commit 50f930db22 upstream. If ksmbd_iov_pin_rsp return error, use-after-free can happen by accessing opinfo->state and opinfo_put and ksmbd_fd_put could called twice. Reported-by: Ziyan Xu <research@securitygossip.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-07-17 18:35:22 +02:00
..
mgmt	ksmbd: fix session use-after-free in multichannel connection	2025-04-10 14:37:43 +02:00
asn1.c
asn1.h
auth.c	ksmbd: fix use-after-free in kerberos authentication	2025-05-09 09:43:53 +02:00
auth.h
connection.c	ksmbd: prevent connection release during oplock break notification	2025-03-22 12:50:47 -07:00
connection.h	ksmbd: provide zero as a unique ID to the Mac client	2025-07-06 11:00:06 +02:00
crypto_ctx.c
crypto_ctx.h
glob.h
Kconfig
ksmbd_netlink.h
ksmbd_spnego_negtokeninit.asn1
ksmbd_spnego_negtokentarg.asn1
ksmbd_work.c	ksmbd: fix use-after-free in ksmbd_free_work_struct	2025-03-22 12:50:47 -07:00
ksmbd_work.h	ksmbd: fix use-after-free in ksmbd_free_work_struct	2025-03-22 12:50:47 -07:00
Makefile
misc.c
misc.h
ndr.c
ndr.h
nterr.h
ntlmssp.h
oplock.c	ksmbd: use list_first_entry_or_null for opinfo_get_list()	2025-06-04 14:42:26 +02:00
oplock.h	ksmbd: fix use-after-free in smb_break_all_levII_oplock()	2025-04-25 10:45:49 +02:00
server.c	ksmbd: prevent connection release during oplock break notification	2025-03-22 12:50:47 -07:00
server.h	ksmbd: fix broken transfers when exceeding max simultaneous operations	2024-12-27 13:58:48 +01:00
smb_common.c	smb: server: Fix building with GCC 15	2025-01-02 10:32:05 +01:00
smb_common.h	ksmbd: check outstanding simultaneous SMB operations	2024-11-14 13:19:35 +01:00
smb2misc.c
smb2ops.c
smb2pdu.c	ksmbd: fix potential use-after-free in oplock/lease break ack	2025-07-17 18:35:22 +02:00
smb2pdu.h	ksmbd: provide zero as a unique ID to the Mac client	2025-07-06 11:00:06 +02:00
smbacl.c	ksmbd: validate zero num_subauth before sub_auth is accessed	2025-04-10 14:37:43 +02:00
smbacl.h
smbfsctl.h
smbstatus.h
transport_ipc.c	ksmbd: Prevent integer overflow in calculation of deadtime	2025-04-25 10:45:49 +02:00
transport_ipc.h
transport_rdma.c	smb: server: make use of rdma_destroy_qp()	2025-07-17 18:35:16 +02:00
transport_rdma.h
transport_tcp.c
transport_tcp.h
unicode.c
unicode.h
vfs_cache.c	ksmbd: Fix UAF in __close_file_table_ids	2025-05-18 08:24:04 +02:00
vfs_cache.h
vfs.c	ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()	2025-07-17 18:35:16 +02:00
vfs.h	ksmbd: retry iterate_dir in smb2_query_dir	2025-01-09 13:32:04 +01:00
xattr.h