Re: [BUG] ksmbd: use-after-free on iface_list from the netdev notifier

[Farhad Alemi]

Tested on 388b607d107c07aaade04c7f22f344cab6bdccd3; patched version no
longer panics.
Thanks!

On Thu, Aug 27, 2026 at 7:39 PM Namjae Jeon <linkinjeon@xxxxxxxxxx> wrote:
>
> On Fri, Aug 28, 2026 at 8:08 AM Farhad Alemi <farhad.alemi@xxxxxxxxxxxx> wrote:
> >
> > Hello Namjae Jeon, Namjae Jeon,
> >
> > While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
> > SEFCOM lab, we hit the crash below. Crash reports can be found here:
> >
> >   https://github.com/farhad-alemi/public_bug_reports/tree/main/117-ksmbd-unlocked-iface_list-uaf-netdev-event/
> >
> >   refcount_t: addition on 0; use-after-free.
> >   WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110
> > lib/refcount.c:25, CPU#1: kworker/u8:3/9983
> >   Modules linked in:
> >   CPU: 1 UID: 0 PID: 9983 Comm: kworker/u8:3 Not tainted 7.1.0-rc5 #1
> > PREEMPT(full)
> >   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
> > 1.16.3-debian-1.16.3-2 04/01/2014
> >   Workqueue: netns cleanup_net
> >   RIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25
> >   Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 db 45 27 fd 48 8d 3d 04 03
> > 1a 0b 67 48 0f b9 3a eb 4a e8 c8 45 27 fd 48 8d 3d 01 03 1a 0b <67> 48
> > 0f b9 3a eb 37 e8 b5 45 27 fd 48 8d 3d fe 02 1a 0b 67 48 0f
> >
> > Our reproducer.c is available upon request.
> >
> > Happy to test a patch if that would help.
> Can you test if the attached patch fixes this issue?
>
> Thanks.