Re: [syzbot] [cifs?] KASAN: slab-use-after-free Read in cifs_crypto_secmech_release

[Michail Andreas Michalopoulos]

Hi Paulo,

On Tue, Oct 20, 2026, Paulo Alcantara wrote:
> #syz test: git://git.manguebit.org/linux.git cifs-fixes 

Not sure if you already have verified your patch but
In case this is still helpful:

syzbot has no reproducer for this one, so I tried to make one. The
natural window is tiny (the demultiplex thread only rechecks
tcpStatus when its 7 s receive timeout expires), so I widened it
with a debug msleep(10000) right after tcpStatus = CifsExiting in
cifs_put_tcp_session(). The trigger itself is simple: a TCP listener
on 127.0.0.1:445 that accepts but never answers, a cifs mount of
//127.0.0.1/share against it, and SIGKILL to the mount after 1 s, so
cifs_mount() fails with -ERESTARTSYS and drops the last reference.

Without your patch this gives the same report as syzbot:

  BUG: KASAN: slab-use-after-free in cifs_crypto_secmech_release
   cifs_put_tcp_session
  Freed by task ...:
   clean_demultiplex_info
  CIFS: VFS: cifs_mount failed w/return code = -512

With your patch ("smb: client: fix UAF of TCP_Server_Info in
cifs_put_tcp_session()", fcf942f9eeca) and the same delay at the
same point, 5 rounds run without any KASAN report.

Tested on UML (x86_64, KASAN, PREEMPT) on top of ksmbd-for-next
4623da395dc4, whose fs/smb/client/connect.c is the blob your patch
applies to. Without the delay, 50 rounds on the unfixed kernel did
not hit the race.

The reproducer, run as root:

  import ctypes, os, signal, socket, time
  srv = socket.socket()
  srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
  srv.bind(("127.0.0.1", 445))
  srv.listen(64)
  held = []
  if os.fork() == 0:          # accept, never reply
      while True:
          held.append(srv.accept()[0])
  libc = ctypes.CDLL(None, use_errno=True)
  os.makedirs("/run/cifsmnt", exist_ok=True)
  pid = os.fork()
  if pid == 0:
      libc.mount(b"//127.0.0.1/share", b"/run/cifsmnt", b"cifs", 0,
                 b"username=u,password=p,vers=3.1.1")
      os._exit(0)
  time.sleep(1)
  os.kill(pid, signal.SIGKILL)
  os.waitpid(pid, 0)

In case it helps when you post the patch:

Tested-by: Michail Andreas Michalopoulos <mike.michalo@xxxxxxxxx>

Thanks,
Michalis