Re: [PATCH] cifs: fix use-after-free of server info on cifs_ses_add_channel error

[Namjae Jeon]

On Fri, Oct 9, 2026 at 5:03 PM Henry Martin <bsdhenrymartin@xxxxxxxxx> wrote:
>
> The error path of cifs_ses_add_channel() calls cifs_put_tcp_session()
> before cifs_chan_clear_need_reconnect().  The latter reaches
> cifs_ses_get_chan_index(), which dereferences server->terminate; if
> the put was the final reference, TCP_Server_Info is already freed and
> this is a use-after-free.  Same put-then-use pattern as the recently
> fixed sibling in commit 717e0a25036b6.
>
> Reorder: clear the reconnect bit and drop chan_count under chan_lock
> first, release the server reference last.
>
> This vulnerability was discovered by Tencent CodeBuddy Security.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: ee1d21794e55a ("cifs: handle when server stops supporting multichannel")
> Signed-off-by: Henry Martin <bsdhenrymartin@xxxxxxxxx>
> ---
>  fs/smb/client/sess.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c
> index e095f41b5882..650c0f855a29 100644
> --- a/fs/smb/client/sess.c
> +++ b/fs/smb/client/sess.c
> @@ -626,12 +626,16 @@ cifs_ses_add_channel(struct cifs_ses *ses,
>
>  out:
>         if (rc && chan->server) {
> -               cifs_put_tcp_session(chan->server, 0);
> -
>                 spin_lock(&ses->chan_lock);
>
> -               /* we rely on all bits beyond chan_count to be clear */
> +               /* Clear the reconnect bitmask BEFORE dropping the server
> +                * reference: cifs_ses_get_chan_index() dereferences
> +                * server->terminate, and cifs_put_tcp_session() may be the
> +                * final put that frees chan->server (use-after-free).
> +                */
>                 cifs_chan_clear_need_reconnect(ses, chan->server);
> +
> +               /* we rely on all bits beyond chan_count to be clear */
>                 ses->chan_count--;
>                 /*
>                  * chan_count should never reach 0 as at least the primary
> @@ -639,6 +643,8 @@ cifs_ses_add_channel(struct cifs_ses *ses,
>                  */
>                 WARN_ON(ses->chan_count < 1);
>                 spin_unlock(&ses->chan_lock);
> +
> +               cifs_put_tcp_session(chan->server, 0);
As soon as the lock is released, a new channel can be added in the
slot indicated by the decremented chan_count. Then the final put will
act on the new channel. Please save the server pointer under chan_lock
and use that for cifs_put_tcp_session().