Re: [syzbot] [cifs?] KASAN: slab-use-after-free Read in cifs_crypto_secmech_release

[mixalhs <mike.michalo@gmail.com>]

Hi Paulo,

> On 25 Oct 2026, at 18:29, Paulo Alcantara <pc@manguebit.org> wrote:
> 
> Could you please try your reproducer against
> 
>        git://git.manguebit.org/linux.git cifs-next


Done, on cifs-next 9bc48fb48a3, which has Eduard's 77f5fbc2d0af ("smb:
client: hold server info until cifsd exits"). UML x86_64 with KASAN and
PREEMPT, with the same debug msleep(10000) after tcpStatus = CifsExiting
in cifs_put_tcp_session():

 - cifs-next: no KASAN report (the C reproducer once, the Python one
   for 5 rounds).

 - cifs-next with 77f5fbc2d0af reverted: the same slab-use-after-free
   in cifs_crypto_secmech_release() as syzbot, freed by
   clean_demultiplex_info(). So the reproducer still hits the race on
   this tree.

To see both orders of the final put, I added a temporary pr_info() in
cifs_tcp_server_put():

 - with the delay (5 rounds), cifsd drops its reference first in
   clean_demultiplex_info() and cifs_put_tcp_session() frees the server;

 - without the delay (50 rounds), cifs_put_tcp_session() drops its
   reference first and clean_demultiplex_info() frees the server.

No KASAN reports in either case.

Tested-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>

Thanks,
Michalis