package/kernel/ksmbd/patches/11-ksmbd-fix-infinite-loop-in-ksmbd_conn_handler_loop.patch

   1 From cc4f3b5a6ab4693aba94a45cc073188df4d67175 Mon Sep 17 00:00:00 2001
   2 From: Namjae Jeon <linkinjeon@kernel.org>
   3 Date: Mon, 26 Dec 2022 01:28:52 +0900
   4 Subject: ksmbd: fix infinite loop in ksmbd_conn_handler_loop()
   5
   6 If kernel_recvmsg() return -EAGAIN in ksmbd_tcp_readv() and go round
   7 again, It will cause infinite loop issue. And all threads from next
   8 connections would be doing that. This patch add max retry count(2) to
   9 avoid it. kernel_recvmsg() will wait during 7sec timeout and try to
  10 retry two time if -EAGAIN is returned. And add flags of kvmalloc to
  11 __GFP_NOWARN and __GFP_NORETRY to disconnect immediately without
  12 retrying on memory alloation failure.
  13
  14 Fixes: 0626e66 ("cifsd: add server handler for central processing and tranport layers")
  15 Cc: stable@vger.kernel.org
  16 Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18259
  17 Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
  18 Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
  19 ---
  20  connection.c    | 7 +++++--
  21  transport_tcp.c | 5 ++++-
  22  2 files changed, 9 insertions(+), 3 deletions(-)
  23
  24 --- a/connection.c
  25 +++ b/connection.c
  26 @@ -337,9 +337,12 @@ int ksmbd_conn_handler_loop(void *p)
  27
  28                 /* 4 for rfc1002 length field */
  29                 size = pdu_size + 4;
  30 -               conn->request_buf = kvmalloc(size, GFP_KERNEL);
  31 +               conn->request_buf = kvmalloc(size,
  32 +                                            GFP_KERNEL |
  33 +                                            __GFP_NOWARN |
  34 +                                            __GFP_NORETRY);
  35                 if (!conn->request_buf)
  36 -                       continue;
  37 +                       break;
  38
  39                 memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf));
  40                 if (!ksmbd_smb_request(conn))
  41 --- a/transport_tcp.c
  42 +++ b/transport_tcp.c
  43 @@ -323,6 +323,7 @@ static int ksmbd_tcp_readv(struct tcp_tr
  44         struct msghdr ksmbd_msg;
  45         struct kvec *iov;
  46         struct ksmbd_conn *conn = KSMBD_TRANS(t)->conn;
  47 +       int max_retry = 2;
  48
  49         iov = get_conn_iovec(t, nr_segs);
  50         if (!iov)
  51 @@ -349,9 +350,11 @@ static int ksmbd_tcp_readv(struct tcp_tr
  52                 } else if (conn->status == KSMBD_SESS_NEED_RECONNECT) {
  53                         total_read = -EAGAIN;
  54                         break;
  55 -               } else if (length == -ERESTARTSYS || length == -EAGAIN) {
  56 +               } else if ((length == -ERESTARTSYS || length == -EAGAIN) &&
  57 +                          max_retry) {
  58                         usleep_range(1000, 2000);
  59                         length = 0;
  60 +                       max_retry--;
  61                         continue;
  62                 } else if (length <= 0) {
  63                         total_read = -EAGAIN;