Re: [PATCH] smb/server: prevent file publication after tree disconnect

[Weiming Shi]

Namjae Jeon <linkinjeon@xxxxxxxxxx> 于2026年10月21日周三 10:06写道：
>
> On Wed, Oct 21, 2026 at 2:53 AM Weiming Shi <bestswngs@xxxxxxxxx> wrote:
> >
> > TREE_DISCONNECT closes the tree's published file handles before marking and
> > removing the tree connection. A concurrent CREATE that already holds a tree
> > reference can therefore publish its file after the close pass. When CREATE
> > drops its reference, the tree can be freed while the published file still
> > points to it.
> >
> > Mark and remove the tree connection before closing its files, and serialize
> > both new-open and durable-reconnect volatile ID publication with that state
> > transition. An opener is then either published in time for the close pass
> > or rejected after disconnect with STATUS_NETWORK_NAME_DELETED.
> >
> > Keep a tree reference while a file carries its tree pointer. This protects
> > asynchronous users that can defer the file's final destruction past tree
> > disconnect.
> >
> > The close pass can race the successful FP_NEW to FP_INITED transition.
> > Take the opening request's file reference atomically with that transition.
> > This keeps the file alive until request completion even if teardown removes
> > the ID immediately.
> >
> >   BUG: KASAN: slab-use-after-free in proc_show_files (fs/smb/server/vfs_cache.c:126)
> >   Read of size 4 at addr ff11000101540f80 by task poc/153
> >
> >   Call Trace:
> >     proc_show_files (fs/smb/server/vfs_cache.c:126)
> >     seq_read_iter (fs/seq_file.c:231)
> >     proc_reg_read_iter (fs/proc/inode.c:299)
> >     vfs_read (fs/read_write.c:574)
> >     ksys_read (fs/read_write.c:716)
> >     do_syscall_64 (arch/x86/entry/syscall_64.c:84)
> >     entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> >
> >   Allocated by:
> >     ksmbd_tree_conn_connect (fs/smb/server/mgmt/tree_connect.c:35)
> >     smb2_tree_connect (fs/smb/server/smb2pdu.c:2819)
> >     handle_ksmbd_work (fs/smb/server/server.c:368)
> >
> >   Freed by:
> >     kfree (mm/slub.c:6801)
> >     handle_ksmbd_work (fs/smb/server/server.c:332)
> >
> > Fixes: f44158485826 ("cifsd: add file operations")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Reported-by: <co+d531129f2f9fbf88@xxxxxxx>
> > Assisted-by: LLM
> > Signed-off-by: Weiming Shi <bestswngs@xxxxxxxxx>
> This patch does not apply cleanly to the ksmbd-for-next branch. Could
> you please rebase it onto that branch and resend it?
> Thanks!

Thanks for the heads-up. I'll rebase the patch onto the latest
ksmbd-for-next branch and resend it shortly.

Best regards,
Weiming Shi