[PATCH 6.6.y v3 0/4] ksmbd: validate owner of durable handle on reconnect

[Alva Lan]

v1->v2: add two prerequisite commits
v2->v3: add bf736184d063 ("ksmbd: close durable scavenger races against m_fp_list lookups")  

This series backports four upstream commits to the 6.6.y stable branch.

The patches fix:

1. Patch 1 and 2 are prerequisites that add proper durable handle lifecycle
management (scavenger timer and expiration handling).
2. Patch 3 fixes a missing validation that allowed any authenticated user to 
hijack orphaned durable handles by predicting or brute-forcing the persistent
ID.
3. Patch 4 fixes race conditions in the durable scavenger thread that could 
lead to list corruption (fp->node reuse) and use-after-free when concurrent
m_fp_list walkers interact with handle expiration.

Patches:
  [1/4] ksmbd: avoid reclaiming expired durable opens by the client
  [2/4] ksmbd: add durable scavenger timer
  [3/4] ksmbd: validate owner of durable handle on reconnect
  [4/4] ksmbd: close durable scavenger races against m_fp_list lookups

Testing performed:
  - Boot: x86_64 target
  - Functional regression (all pass):
      * mkdir / rmdir (single, nested, recursive)
      * read / write (small files, 1MB, 10MB)
      * append, rename (file + directory), delete
      * chmod, stat, directory listing
      * concurrent I/O (5 parallel writers)
      * multi-user access (cross-user read/write)
  - CVE-specific tests (all pass):
      * Race 1: fp->node list-head reuse — no CONFIG_DEBUG_LIST reports
      * Race 2: UAF via refcount race — no KASAN reports under concurrent
        rename + scavenger expiry
      * persistent_id recycling — new handles remain valid after old ones
        expire
      * open_files_count — no underflow when detached fp closed by
        unrelated connection
      * Owner validation — same user reconnects successfully; different
        user cannot hijack durable handle via DHnC
  - Server stability: ksmbd remains healthy after all stress tests,
    dmesg clean (no list corruption, KASAN, UAF, ODEBUG, or WARNING)

DaeMyung Kang (1):
  ksmbd: close durable scavenger races against m_fp_list lookups

Namjae Jeon (3):
  ksmbd: avoid reclaiming expired durable opens by the client
  ksmbd: add durable scavenger timer
  ksmbd: validate owner of durable handle on reconnect

 fs/smb/server/mgmt/user_session.c |  10 +-
 fs/smb/server/oplock.c            |   7 +
 fs/smb/server/oplock.h            |   1 +
 fs/smb/server/server.c            |   1 +
 fs/smb/server/server.h            |   1 +
 fs/smb/server/smb2pdu.c           |   5 +-
 fs/smb/server/smb2pdu.h           |   2 +
 fs/smb/server/vfs_cache.c         | 309 ++++++++++++++++++++++++++++--
 fs/smb/server/vfs_cache.h         |  15 +-
 9 files changed, 329 insertions(+), 22 deletions(-)

-- 
2.43.0