Re: [PATCH] smb: client: fix early procfs exposure race

[Paulo Alcantara]

Fredric Cover <fredric.cover.lkernel@xxxxxxxxx> writes:

> Currently, init_cifs() calls cifs_proc_init() near the beginning of
> the function, before INIT_LIST_HEAD, leading to a momentarily
> uninitialized, but exposed, procfs. If a userspace process reads this
> empty procfs, iterating over a zeroed list_head leads to a NULL
> pointer dereference and a kernel oops/panic.
>
> For example, if a delay is added between cifs_proc_init() and
> INIT_LIST_HEAD, and a userspace process is polling
> /proc/fs/cifs/DebugData, the following oops occurs:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000608
> PGD 0 P4D 0
> Oops: Oops: 0000 [#1] SMP PTI
> CPU: 0 UID: 0 PID: 3477 Comm: cat Not tainted 7.3.0-02212-g4df4d2a577db-dirty #6 PREEMPT(lazy)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 2025.11-3ubuntu7.3 09/23/2026
> RIP: 0010:cifs_debug_data_proc_show+0x103/0xd80 [cifs]
> Code: 00 31 d2 eb 25 48 89 df 48 c7 c6 4b d4 67 c0 e8 a3 12 f5 cb 48 8b 54 24 28 48 8b 6d 00 48 81 fd 28 3b 60 c0 0f 84 34 0c 00 00 <48> 83 bd 08 06 00 00 00 75 e5 ff c2 48 8b
> 4d 38 48 89 df 48 c7 c6
> RSP: 0018:ffffb603c03c7c38 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: ffff950240d3f2a0 RCX: 0000000000000001
> RDX: 0000000000000000 RSI: ffffffffc0672ab7 RDI: ffffffffc0603ad8
> RBP: 0000000000000000 R08: 737265767265530a R09: 203a737265767265
> R10: 6552205346562065 R11: 203a737473657571 R12: 0000000000000000
> R13: ffffb603c03c7d68 R14: ffff950240d3f2a0 R15: 0000000000000001
> FS:  00007fdae19d9b00(0000) GS:ffff95032d4bb000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000608 CR3: 000000010638e001 CR4: 0000000000370ef0
> Call Trace:
> <TASK>
>  ? seq_read_iter+0x86/0x400
>  ? seq_read_iter+0x86/0x400
>  seq_read_iter+0x183/0x400
>  proc_reg_read_iter+0x62/0x90
>  copy_splice_read+0x215/0x310
>  splice_file_to_pipe+0xec/0x1c0
>  do_splice+0x4b8/0x780
>  __se_sys_splice+0x18f/0x250
>  do_syscall_64+0x109/0x330
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> </TASK>
>
> Fix this by moving cifs_proc_init() down in init_cifs(), ensuring it runs
> only after all internal lists, locks, counters, and workqueues are fully
> ready, but before registering the filesystem. Update the error cleanup
> ladder and exit_cifs() to maintain proper LIFO order.
> ...

Applied.