[PATCH] ksmbd: revert fsids on durable reconnect and replay failure

[Ian Bridges <icb@fastmail.org>]

On a durable handle reconnect or a request replay, smb2_open() switches
to the SMB user's fsids before calling ksmbd_vfs_getattr(). If that call
fails, the code jumps to err_out2 and skips ksmbd_revert_fsids() at
err_out1. The user's credentials then stay installed on the shared ksmbd
worker. Later work on that worker, including other users' requests, runs
with the first user's fsuid, fsgid and supplementary groups.
ksmbd_free_work_struct() also warns, because work->saved_cred is still
set.

Jump to err_out1 instead. No path is held at this point, so skipping the
path_put() at err_out is correct.

Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2")
Fixes: bb8bf7eb13b5 ("ksmbd: add SMB3 request replay support")
Cc: stable@vger.kernel.org
Signed-off-by: Ian Bridges <icb@fastmail.org>
---

Notes:
    Reachable with "durable handles = yes" or through request replay when
    ksmbd_vfs_getattr() fails, for example when an LSM denies it or the
    filesystem returns ESTALE. Later work on that worker runs as the wrong
    user. The leaked credential is ksmbd's own override for that user, so it
    is not a privilege escalation.
    
    Tested on ksmbd-for-next bd24b89645c5 with the getattr failure forced by
    a debug hook on both paths. Before this change, each failure trips the
    WARN_ON() in ksmbd_free_work_struct(). The worker then serves another
    user with the first user's fsuid. With this change there is no warning,
    and each user's requests run with their own credentials. An ordinary
    durable reconnect still works. The natural triggers were not tested.
    
    A reproducer is available on request.
    
    This fix was developed with LLM assistance.

 fs/smb/server/smb2pdu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index f3cd6ff7eb09..b126eda48318 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -4526,7 +4526,7 @@ int smb2_open(struct ksmbd_work *work)
 			file_info = FILE_OPENED;
 			rc = ksmbd_vfs_getattr(&fp->filp->f_path, &stat);
 			if (rc)
-				goto err_out2;
+				goto err_out1;
 
 			goto reconnected_fp;
 		}
@@ -4556,7 +4556,7 @@ int smb2_open(struct ksmbd_work *work)
 
 			rc = ksmbd_vfs_getattr(&fp->filp->f_path, &stat);
 			if (rc)
-				goto err_out2;
+				goto err_out1;
 
 			goto reconnected_fp;
 		}

base-commit: bd24b89645c5fa8283aceda78dbe53aa234e6bf9
-- 
2.47.3