[PATCH] cifs: fix use-after-free of server info on cifs_ses_add_channel error

[Henry Martin]

The error path of cifs_ses_add_channel() calls cifs_put_tcp_session()
before cifs_chan_clear_need_reconnect().  The latter reaches
cifs_ses_get_chan_index(), which dereferences server->terminate; if
the put was the final reference, TCP_Server_Info is already freed and
this is a use-after-free.  Same put-then-use pattern as the recently
fixed sibling in commit 717e0a25036b6.

Reorder: clear the reconnect bit and drop chan_count under chan_lock
first, release the server reference last.

This vulnerability was discovered by Tencent CodeBuddy Security.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: ee1d21794e55a ("cifs: handle when server stops supporting multichannel")
Signed-off-by: Henry Martin <bsdhenrymartin@xxxxxxxxx>
---
 fs/smb/client/sess.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c
index e095f41b5882..650c0f855a29 100644
--- a/fs/smb/client/sess.c
+++ b/fs/smb/client/sess.c
@@ -626,12 +626,16 @@ cifs_ses_add_channel(struct cifs_ses *ses,

 out:
 	if (rc && chan->server) {
-		cifs_put_tcp_session(chan->server, 0);
-
 		spin_lock(&ses->chan_lock);

-		/* we rely on all bits beyond chan_count to be clear */
+		/* Clear the reconnect bitmask BEFORE dropping the server
+		 * reference: cifs_ses_get_chan_index() dereferences
+		 * server->terminate, and cifs_put_tcp_session() may be the
+		 * final put that frees chan->server (use-after-free).
+		 */
 		cifs_chan_clear_need_reconnect(ses, chan->server);
+
+		/* we rely on all bits beyond chan_count to be clear */
 		ses->chan_count--;
 		/*
 		 * chan_count should never reach 0 as at least the primary
@@ -639,6 +643,8 @@ cifs_ses_add_channel(struct cifs_ses *ses,
 		 */
 		WARN_ON(ses->chan_count < 1);
 		spin_unlock(&ses->chan_lock);
+
+		cifs_put_tcp_session(chan->server, 0);
 	}

 	kfree(ctx->UNC);
--
2.43.7