moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ksmbd: fix infinite loop in ksmbd_conn_handler_loop()

Browse Source 
commit 83dcedd5540d4ac61376ddff5362f7d9f866a6ec upstream.

If kernel_recvmsg() return -EAGAIN in ksmbd_tcp_readv() and go round
again, It will cause infinite loop issue. And all threads from next
connections would be doing that. This patch add max retry count(2) to
avoid it. kernel_recvmsg() will wait during 7sec timeout and try to
retry two time if -EAGAIN is returned. And add flags of kvmalloc to
__GFP_NOWARN and __GFP_NORETRY to disconnect immediately without
retrying on memory alloation failure.

Fixes: 0626e6641f ("cifsd: add server handler for central processing and tranport layers")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18259
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Namjae Jeon
2022-12-31 17:32:31 +09:00
committed by Greg Kroah-Hartman
parent f10defb0be
commit 4136f1ac1e
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
fs/ksmbd/connection.c
View File

@@ -310,9 +310,12 @@ int ksmbd_conn_handler_loop(void *p)
/* 4 for rfc1002 length field */ /* 4 for rfc1002 length field */
size = pdu_size + 4; size = pdu_size + 4;
conn->request_buf = kvmalloc(size, GFP_KERNEL); conn->request_buf = kvmalloc(size,
GFP_KERNEL |
__GFP_NOWARN |
__GFP_NORETRY);
if (!conn->request_buf) if (!conn->request_buf)
continue; break;
memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf)); memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
if (!ksmbd_smb_request(conn)) if (!ksmbd_smb_request(conn))

5
fs/ksmbd/transport_tcp.c
View File

@@ -295,6 +295,7 @@ static int ksmbd_tcp_readv(struct tcp_transport *t, struct kvec *iov_orig,
struct msghdr ksmbd_msg; struct msghdr ksmbd_msg;
struct kvec *iov; struct kvec *iov;
struct ksmbd_conn *conn = KSMBD_TRANS(t)->conn; struct ksmbd_conn *conn = KSMBD_TRANS(t)->conn;
int max_retry = 2;
iov = get_conn_iovec(t, nr_segs); iov = get_conn_iovec(t, nr_segs);
if (!iov) if (!iov)
@@ -321,9 +322,11 @@ static int ksmbd_tcp_readv(struct tcp_transport *t, struct kvec *iov_orig,
} else if (conn->status == KSMBD_SESS_NEED_RECONNECT) { } else if (conn->status == KSMBD_SESS_NEED_RECONNECT) {
total_read = -EAGAIN; total_read = -EAGAIN;
break; break;
} else if (length == -ERESTARTSYS || length == -EAGAIN) { } else if ((length == -ERESTARTSYS || length == -EAGAIN) &&
max_retry) {
usleep_range(1000, 2000); usleep_range(1000, 2000);
length = 0; length = 0;
max_retry--;
continue; continue;
} else if (length <= 0) { } else if (length <= 0) {
total_read = -EAGAIN; total_read = -EAGAIN;