Re: [PATCH] ksmbd: fix tree connection use-after-free in smb2_tree_connect()

[Namjae Jeon]

On Wed, Sep 2, 2026 at 3:21 AM Cen Zhang (Microsoft Security FORGE
Labs) <cenzhang@xxxxxxxxxxxxxxxxxxx> wrote:
>
> ksmbd_tree_conn_connect() publishes a new tree connection in
> sess->tree_conns with a single reference and returns its pointer to
> smb2_tree_connect(). The handler continues to initialize the object and
> build the response after publication. A concurrent session logoff can
> erase the connection and drop that reference, freeing the object while
> the handler still uses it.
>
> BUG: KASAN: slab-use-after-free in smb2_tree_connect+0xe3d/0xf90
>   smb2_tree_connect (fs/smb/server/smb2pdu.c:2872)
>   handle_ksmbd_work
>   process_one_work
>   worker_thread
>   kthread
>
> After xa_store() succeeds, take a second reference before releasing
> tree_conns_lock. The original reference belongs to the xarray entry and
> the second belongs to the creating smb2_tree_connect() handler.
>
> Keep the references balanced in every path:
>
> - On normal exit or an error after publication, smb2_tree_connect()
>   drops its creator reference. Error cleanup also calls
>   ksmbd_tree_conn_disconnect(), which drops the xarray reference only if
>   it removes the exact entry.
> - SMB2 TREE_DISCONNECT uses the same helper to remove the entry and drop
>   its xarray reference. The request's existing lookup reference remains
>   owned by the request and is released by the existing cleanup.
> - Session LOGOFF removes each entry and drops its xarray reference. If
>   it wins the race, later cleanup sees that the entry is gone and does
>   not drop that reference again.
>
> To enforce this ownership, claim the disconnected state and erase the
> exact entry atomically under tree_conns_lock. This guarantees one drop
> for the xarray reference and one drop by each in-flight user, regardless
> of which teardown path wins. If logoff removes the entry before
> initialization completes, fail the connect instead of marking the
> detached object TREE_CONNECTED.
>
> Fixes: 33b235a6e6eb ("ksmbd: fix race condition between tree conn lookup and disconnect")
> Reported-by: Xiang Mei (Microsoft) <xmei5@xxxxxxx>
> Cc: AutonomousCodeSecurity@xxxxxxxxxxxxx
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Cen Zhang (Microsoft Security FORGE Labs) <cenzhang@xxxxxxxxxxxxxxxxxxx>
Applied it to #ksmbd-for-next.
Thanks!