[lvc-project] [PATCH 3/3] ksmbd: do not release session id 0 on init failure

[Dmitriy Okunev]

When __session_create() fails before __init_smb2_session() assigns an
id, sess->id remains 0 because the session was allocated with kzalloc.
ksmbd_session_destroy() then calls ksmbd_release_id(&session_ida,
sess->id), and since ida_alloc_min() has not yet been called,
ida_free(ida, 0) triggers:

  ida_free called for id=0 which is not allocated.
  WARNING: lib/idr.c:594 at ida_free+0x18c/0x250
  ...
  ksmbd_release_id+0xd/0x10
  ksmbd_session_destroy+0x2d5/0x380
  ksmbd_smb2_session_create+0x131/0x160
  ...

Add a check for sess->id > 0  before  the release,
since ids are allocated starting from 1
(ida_alloc_min(ida,1,...)).

Found by Linux Verification Center (linuxtesting.org).

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: Dmitriy Okunev <dokunevdmitriy at gmail.com>
---
 fs/smb/server/mgmt/user_session.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c
index 386c8629e134..d46dc7b2c562 100644
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -409,7 +409,8 @@ void ksmbd_session_destroy(struct ksmbd_session *sess)
 	ksmbd_session_rpc_clear_list(sess);
 	free_channel_list(sess);
 	kfree_sensitive(sess->Preauth_HashValue);
-	ksmbd_release_id(&session_ida, sess->id);
+	if (sess->id > 0)
+		ksmbd_release_id(&session_ida, sess->id);
 	ida_destroy(&sess->tree_conn_ida);
 	kfree_sensitive(sess);
 }
-- 
2.53.0