Skip to content

Commit eb307d0

Browse files
namjaejeonSteve French
authored andcommitted
ksmbd: call rcu_barrier() in ksmbd_server_exit()
racy issue is triggered the bug by racing between closing a connection and rmmod. In ksmbd, rcu_barrier() is not called at module unload time, so nothing prevents ksmbd from getting unloaded while it still has RCU callbacks pending. It leads to trigger unintended execution of kernel code locally and use to defeat protections such as Kernel Lockdown Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20477 Signed-off-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
1 parent 3021094 commit eb307d0

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

fs/ksmbd/server.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -606,6 +606,7 @@ static int __init ksmbd_server_init(void)
606606
static void __exit ksmbd_server_exit(void)
607607
{
608608
ksmbd_server_shutdown();
609+
rcu_barrier();
609610
ksmbd_release_inode_hash();
610611
}
611612

0 commit comments

Comments
 (0)