Re: [PATCH] ksmbd: fix use-after-free after a failed durable reconnect

[Namjae Jeon]

On Wed, Oct 28, 2026 at 12:25 AM Ian Bridges <icb@xxxxxxxxxxxx> wrote:
>
> ksmbd_reopen_durable_fd() republishes a detached durable handle in the
> reconnecting session's file table and takes no reference for that entry.
> If smb2_open() then fails, cleanup relies on the final ksmbd_fd_put() to
> remove the volatile id.
>
> Two reconnects of the same handle can both take a lookup reference before
> either attaches it. If the one that reopens first then fails and drops
> its references first, the other request makes the final put through
> ksmbd_put_durable_fd(). That frees the handle without removing the first
> session's table entry, so tearing that session down writes to freed
> memory.
>
>   BUG: KASAN: slab-use-after-free in __close_file_table_ids+0x14d/0x740 [ksmbd]
>   Call Trace:
>    __close_file_table_ids+0x14d/0x740 [ksmbd]
>    ksmbd_destroy_file_table+0x76/0x100 [ksmbd]
>    ksmbd_session_destroy+0xf8/0x480 [ksmbd]
>    ksmbd_dispose_sessions+0x13e/0x200 [ksmbd]
>    ksmbd_conn_sessions_cleanup+0x4c3/0x6d0 [ksmbd]
>   Freed by task 1030:
>    __ksmbd_close_fd+0x97d/0x1000 [ksmbd]
>    smb2_open+0x14eb/0xd9f0 [ksmbd]
>
> Commit 3515503322f4 ("ksmbd: fix durable reconnect error path file
> lifetime") handles a final put made by the reconnecting request, but not
> one made by another holder.
>
> Remove the volatile id under the file-table lock on this error path,
> before the references are dropped, as ksmbd_close_fd() does on the
> request_open path just above. Removal then no longer depends on which
> holder makes the final put. The stale comment in the reconnect cleanup
> is updated to match. A successful reconnect is unchanged.
>
> Fixes: c8efcc786146 ("ksmbd: add support for durable handles v1/v2")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ian Bridges <icb@xxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!