Re: [PATCH 1/2] ksmbd: fix active_num_conn leak when alloc_transport() fails

[Namjae Jeon]

On Sun, Apr 19, 2026 at 2:30 AM DaeMyung Kang <charsyam@xxxxxxxxx> wrote:
>
> ksmbd_kthread_fn() increments active_num_conn right after accept(),
> before calling ksmbd_tcp_new_connection().  The decrement normally
> happens in ksmbd_tcp_disconnect() at the end of the connection's
> lifetime.
>
> If alloc_transport() fails in ksmbd_tcp_new_connection(), the function
> releases the socket and returns -ENOMEM without going through
> ksmbd_tcp_disconnect(), so active_num_conn never gets decremented.
> Under memory pressure, repeated failures monotonically inflate the
> counter until max_connections is reached and new clients are refused
> indefinitely.
>
> Decrement active_num_conn on this error path, matching the accounting
> rule used by ksmbd_kthread_fn() and ksmbd_tcp_disconnect().
>
> Commit 77ffbcac4e56 ("smb: server: fix leak of active_num_conn in
> ksmbd_tcp_new_connection()") fixed the sibling leak on the kthread_run()
> failure path; this patch closes the remaining one.
>
> Reproduced with a debug build that adds a temporary module parameter
> guarding an early return at the top of alloc_transport(), forcing
> the first N accept-time transport allocations to fail:
>
>   * Configure ksmbd with "max connections = 3".
>   * Force 5 successive alloc_transport() failures at the accept path.
>   * Without the fix: active_num_conn drifts up to max_connections and
>     subsequent legitimate mount.cifs attempts are refused with
>     "ksmbd: Limit the maximum number of connections(3)" in dmesg.
>   * With the fix: the counter is correctly decremented on each
>     failure and legitimate mounts continue to succeed.
>
> Tested by injecting 5 alloc_transport() failures with
> max_connections=3 and verifying that subsequent mount.cifs attempts
> still succeed on the patched kernel while the unpatched kernel
> refuses them.
>
> Fixes: 0d0d4680db22 ("ksmbd: add max connections parameter")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: DaeMyung Kang <charsyam@xxxxxxxxx>
Looks good, but Michael Bommarito has already submitted the same patch
to the list, and it has been merged into the ksmbd-for-next branch as
shown below.
https://github.com/smfrench/smb3-kernel/commit/6551300dc452ac16a855a83dbd1e74899542d3b3

Thanks!