Re: [PATCH] ksmbd: fix session reference leak on compounded SESSION_SETUP

[Namjae Jeon]

On Wed, Oct 28, 2026 at 12:21 AM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> A compound request can place SESSION_SETUP after another command. That
> earlier command leaves a reference to its session in work->sess.
> smb2_sess_setup() then overwrites work->sess with the session it looks up
> or creates, and the dispatcher later puts work->sess only once. The
> inherited reference is never dropped. That leaks the session, together
> with its setup connection and socket, and every repeat of the compound
> leaks another.
>
>   unreferenced object (size 512):
>     __kmalloc_cache_noprof+0x32c/0x3a0
>     ksmbd_smb2_session_create+0xf6/0x9c0 [ksmbd]
>     smb2_sess_setup+0xda4/0x6280 [ksmbd]
>     handle_ksmbd_work+0x88c/0x1cb0 [ksmbd]
>
> Save the inherited session on entry. After the request has been
> processed, release it once, but only when smb2_sess_setup() has replaced
> work->sess with its own session or cleared it. Do this after
> ksmbd_conn_unlock() so the put does not run under srv_mutex. An error path
> may instead leave the inherited session in work->sess. Keep it there, so
> the dispatcher still puts it and the error response is still signed or
> encrypted with it as before.
>
> Fixes: 7aa8804c0b67 ("ksmbd: fix user-after-free from session log off")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!