From: Namjae Jeon <linkinjeon@kernel.org>
To: DaeMyung Kang <charsyam@gmail.com>
Cc: smfrench@gmail.com, senozhatsky@chromium.org, tom@talpey.com,
linux-cifs@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org,
Henrique Carvalho <henrique.carvalho@suse.com>
Subject: Re: [PATCH 1/2] ksmbd: fix active_num_conn leak when alloc_transport() fails
Date: Sun, 19 Apr 2026 16:30:20 +0900 [thread overview]
Message-ID: <CAKYAXd8=ckDwaYgKFZQG80umwKBO1S2UuTWq34qq8hRQ0Nz2tA@mail.gmail.com> (raw)
In-Reply-To: <20260418172844.1333378-2-charsyam@gmail.com>
On Sun, Apr 19, 2026 at 2:30 AM DaeMyung Kang <charsyam@gmail.com> wrote:
>
> ksmbd_kthread_fn() increments active_num_conn right after accept(),
> before calling ksmbd_tcp_new_connection(). The decrement normally
> happens in ksmbd_tcp_disconnect() at the end of the connection's
> lifetime.
>
> If alloc_transport() fails in ksmbd_tcp_new_connection(), the function
> releases the socket and returns -ENOMEM without going through
> ksmbd_tcp_disconnect(), so active_num_conn never gets decremented.
> Under memory pressure, repeated failures monotonically inflate the
> counter until max_connections is reached and new clients are refused
> indefinitely.
>
> Decrement active_num_conn on this error path, matching the accounting
> rule used by ksmbd_kthread_fn() and ksmbd_tcp_disconnect().
>
> Commit 77ffbcac4e56 ("smb: server: fix leak of active_num_conn in
> ksmbd_tcp_new_connection()") fixed the sibling leak on the kthread_run()
> failure path; this patch closes the remaining one.
>
> Reproduced with a debug build that adds a temporary module parameter
> guarding an early return at the top of alloc_transport(), forcing
> the first N accept-time transport allocations to fail:
>
> * Configure ksmbd with "max connections = 3".
> * Force 5 successive alloc_transport() failures at the accept path.
> * Without the fix: active_num_conn drifts up to max_connections and
> subsequent legitimate mount.cifs attempts are refused with
> "ksmbd: Limit the maximum number of connections(3)" in dmesg.
> * With the fix: the counter is correctly decremented on each
> failure and legitimate mounts continue to succeed.
>
> Tested by injecting 5 alloc_transport() failures with
> max_connections=3 and verifying that subsequent mount.cifs attempts
> still succeed on the patched kernel while the unpatched kernel
> refuses them.
>
> Fixes: 0d0d4680db22 ("ksmbd: add max connections parameter")
> Cc: stable@vger.kernel.org
> Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Looks good, but Michael Bommarito has already submitted the same patch
to the list, and it has been merged into the ksmbd-for-next branch as
shown below.
https://github.com/smfrench/smb3-kernel/commit/6551300dc452ac16a855a83dbd1e74899542d3b3
Thanks!
next prev parent reply other threads:[~2026-04-19 7:30 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-18 17:28 [PATCH 0/2] ksmbd: connection accounting and session teardown fixes DaeMyung Kang
2026-04-18 17:28 ` [PATCH 1/2] ksmbd: fix active_num_conn leak when alloc_transport() fails DaeMyung Kang
2026-04-19 7:30 ` Namjae Jeon [this message]
2026-04-18 17:28 ` [PATCH 2/2] ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() DaeMyung Kang
2026-04-19 7:29 ` Namjae Jeon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAKYAXd8=ckDwaYgKFZQG80umwKBO1S2UuTWq34qq8hRQ0Nz2tA@mail.gmail.com' \
--to=linkinjeon@kernel.org \
--cc=charsyam@gmail.com \
--cc=henrique.carvalho@suse.com \
--cc=linux-cifs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=senozhatsky@chromium.org \
--cc=smfrench@gmail.com \
--cc=stable@vger.kernel.org \
--cc=tom@talpey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).