Re: [PATCH] ksmbd: fix use-after-free of lease table in smb2_lease_break_noti()

[Namjae Jeon]

On Wed, Aug 19, 2026 at 6:09 PM Abdifatah Suruur <suruurism@xxxxxxxxx> wrote:
>
> smb2_lease_break_noti() redirects v2 lease break notifications to the
> client lease channel by reading lease->l_lb->conn.  The lease table is
> linked into the global lease_table_list and destroyed by
> destroy_lease_table() on connection teardown, which unlinks it and
> kfree()s it under write_lock(&lease_list_lock).
>
> The break path dereferences lease->l_lb and lease->l_lb->conn without
> holding lease_list_lock, so when the owning connection is torn down
> concurrently (e.g. the client disconnects while another connection's
> open triggers a lease break), the table can be freed between the load
> and the dereference.  This is a use-after-free read of struct
> lease_table; the stale conn pointer is then passed to
> ksmbd_conn_releasing() and ksmbd_conn_get(), corrupting a refcount on
> memory that may have been reallocated.
>
> Take a conn reference and perform the lease-table lookup under
> read_lock(&lease_list_lock), matching the lock discipline of
> find_same_lease_key() and lookup_lease_in_table(), and transfer the
> reference to the async work item instead of re-taking it.
>
> Fixes: 2145945feb2c2 ("ksmbd: route v2 lease breaks on the client lease channel")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Abdifatah Suruur <suruurism@xxxxxxxxx>
We have a better patch below.

https://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git/commit/?h=ksmbd-for-next&id=3a98de41b0a4d80e0aa57f677f7592e5f5321613

Thanks.