[SRU][J][PATCH 1/1] ksmbd: fix type confusion via race condition when using ipc_msg_send_request

[Cengiz Can]

From: Namjae Jeon <linkinjeon at kernel.org>

req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on
ida_alloc. req->handle from ksmbd_ipc_login_request and
FSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion
between messages, resulting in access to unexpected parts of memory after
an incorrect delivery. ksmbd check type of ipc response but missing add
continue to check next ipc reponse.

Cc: stable at vger.kernel.org
Reported-by: Norbert Szetei <norbert at doyensec.com>
Tested-by: Norbert Szetei <norbert at doyensec.com>
Signed-off-by: Namjae Jeon <linkinjeon at kernel.org>
Signed-off-by: Steve French <stfrench at microsoft.com>
(backported from commit e2ff19f0b7a30e03516e6eb73b948e27a55bc9d2)
[bot_kybele: backported to jammy/linux; review and refine this note]
CVE-2025-21947
Assisted-by: kybele:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
---
 fs/ksmbd/transport_ipc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ksmbd/transport_ipc.c b/fs/ksmbd/transport_ipc.c
index 181b8bb18a95..e1f7d56fb513 100644
--- a/fs/ksmbd/transport_ipc.c
+++ b/fs/ksmbd/transport_ipc.c
@@ -266,6 +266,7 @@ static int handle_response(int type, void *payload, size_t sz)
 		if (entry->type + 1 != type) {
 			pr_err("Waiting for IPC type %d, got %d. Ignore.\n",
 			       entry->type + 1, type);
+			continue;
 		}
 
 		entry->response = kvzalloc(sz, GFP_KERNEL);
-- 
2.53.0