Re: [PATCH] ksmbd: fix app-instance non-durable supersede session UAF

[Namjae Jeon]

On Mon, Oct 26, 2026 at 2:35 PM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> ksmbd_close_fd_app_instance_id() supersedes a prior open that has the
> same AppInstanceId. It reaches that open's session through opinfo->sess.
> This pointer is not refcounted.
>
> Session teardown detaches durable handles before it frees the session.
> It does not detach a non-durable open. That open still points at the
> session through opinfo->sess after the session is freed. Another session
> can supersede the open at the same time. The supersede then takes a
> write lock through the stale pointer, in the freed session's file table.
>
>   BUG: KASAN: slab-use-after-free in _raw_write_lock+0x71/0xd0
>   Call Trace:
>    _raw_write_lock+0x71/0xd0
>    ksmbd_close_fd_app_instance_id+0xd9/0x670 [ksmbd]
>    smb2_open+0x3e10/0xd910 [ksmbd]
>   Freed by task 212:
>    ksmbd_session_destroy+0x38d/0x480 [ksmbd]
>
> Fix this by looking the session up by opinfo->session_id. The lookup
> returns a reference, as smb2_break_collect_channels() does. Recheck that
> opinfo->sess still points at it before using it.
>
> Do the lookup without m_lock held. destroy_previous_session() takes
> m_lock under the session table lock, and taking them in the other order
> here would deadlock.
>
> Fixes: 16c30649709d ("ksmbd: handle durable v2 app instance id")
> Cc: stable@xxxxxxxxxxxxxxx # e0386cd6498b: ksmbd: validate AppInstanceId takeover target
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!