[lvc-project] [PATCH 3/3] ksmbd: do not release session id 0 on init failure

[Namjae Jeon]

On Tue, Oct 20, 2026 at 11:36 PM Dmitriy Okunev
<dokunevdmitriy at gmail.com> wrote:
>
> When __session_create() fails before __init_smb2_session() assigns an
> id, sess->id remains 0 because the session was allocated with kzalloc.
> ksmbd_session_destroy() then calls ksmbd_release_id(&session_ida,
> sess->id), and since ida_alloc_min() has not yet been called,
> ida_free(ida, 0) triggers:
>
>   ida_free called for id=0 which is not allocated.
>   WARNING: lib/idr.c:594 at ida_free+0x18c/0x250
>   ...
>   ksmbd_release_id+0xd/0x10
>   ksmbd_session_destroy+0x2d5/0x380
>   ksmbd_smb2_session_create+0x131/0x160
>   ...
>
> Add a check for sess->id > 0  before  the release,
> since ids are allocated starting from 1
> (ida_alloc_min(ida,1,...)).
>
> Found by Linux Verification Center (linuxtesting.org).
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Signed-off-by: Dmitriy Okunev <dokunevdmitriy at gmail.com>
Thanks for the patches. All three issues have already been fixed in
#ksmbd-for-next by commit dc6aa1ba8b7f ("ksmbd: limit sessions on each
connection")

https://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git/commit/?id=dc6aa1ba8b7fff8800ad9bf143f17d308e02ec68

Thanks.