[PATCH 1/3] ksmbd: fix uninitialized locks in __session_create() error path

[Dmitriy Okunev]

In __session_create(), the ksmbd_init_file_table() call is
made before the tree_conns_lock, rpc_lock and chann_lock rw_semaphores
are initialized with init_rwsem().  If ksmbd_init_file_table() fails
(which can happen on -ENOMEM), the error path calls
ksmbd_session_destroy(), which in turn calls
ksmbd_tree_conn_session_logoff(), ksmbd_session_rpc_clear_list() and
free_channel_list(). All three functions call down_write() with
uninitialized rw_semaphore.

INFO: trying to register non-static key.
  ...
  down_write+0x7d/0x1c0
  ksmbd_tree_conn_session_logoff+0xa2/0x1f0
  ksmbd_session_destroy+0xaf/0x380
  ksmbd_smb2_session_create+0xdb/0x110
  ...

Fix it by moving the three init_rwsem() calls above
ksmbd_init_file_table(), so that all locks are valid on every error
path.

Found by Linux Verification Center (linuxtesting.org).

Fixes: a1f46c99d9ea ("ksmbd: fix use-after-free in ksmbd_session_rpc_open")
Signed-off-by: Dmitriy Okunev <dokunevdmitriy@xxxxxxxxx>
---
 fs/smb/server/mgmt/user_session.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c
index 44dc3f800cd4..fc28088772ac 100644
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -844,6 +844,10 @@ static struct ksmbd_session *__session_create(int protocol)
 
 	ida_init(&sess->tree_conn_ida);
 
+	init_rwsem(&sess->tree_conns_lock);
+	init_rwsem(&sess->rpc_lock);
+	init_rwsem(&sess->chann_lock);
+
 	if (ksmbd_init_file_table(&sess->file_table))
 		goto error;
 
@@ -855,9 +859,6 @@ static struct ksmbd_session *__session_create(int protocol)
 	xa_init(&sess->rpc_handle_list);
 	sess->sequence_number = 1;
 	atomic_set(&sess->refcnt, 2);
-	init_rwsem(&sess->tree_conns_lock);
-	init_rwsem(&sess->rpc_lock);
-	init_rwsem(&sess->chann_lock);
 
 	ret = __init_smb2_session(sess);
 	if (ret)
-- 
2.53.0