From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo2-f11.google.com (mail-oo2-f11.google.com [74.125.231.139]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 664414848BC for ; Fri, 9 Oct 2026 08:03:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.231.139 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791532987; cv=none; b=njbDSgXvILP2xvpvq91Exv9FTRN580ameafzu8sbam5yeRQio0dvl23WJlJzASMBa5ZI3BWof2IMzIX4wv3tLxuQgQzBmt3gPIepy7i1jKrmcv3iA9IdaPraVgpc0Nrh1qiGI93iAml01hyPonv+Nb6I7wVZqxjpK5w6Uxfgjj4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791532987; c=relaxed/simple; bh=PNIWbf1MaE9ijfXHPhmWrJ+aqZsWffS2Dcf0qEM2kxk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=pk9OLu48/xpw91FdgIpmpy2XZzlHJzxCTGpQSOllUEPRNRak9qXYo3HtFtorWxD0DZg3ydKaiW7QAxfDA1GqZeUG7BQ7qkcudTNsOQ3p0Y0jFouZQkUjnGhESFza57zFtUDSLUQYop5wLGtt+2iMOliaeaJcTssUN9t5zJvBCr4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=j6a09IS7; arc=none smtp.client-ip=74.125.231.139 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="j6a09IS7" Received: by mail-oo2-f11.google.com with SMTP id 46e09a7af769-82757b1535eso1511472a34.0 for ; Fri, 09 Oct 2026 01:03:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791532983; x=1792137783; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=abrjBZtqWK4ithY2rB/XsxNJwm1DdDO75e5ZEpU8VL4=; b=j6a09IS7hRbMC4+xv+vZkh4RTWexSe62b1qUFs/0A0aiDSlyo3BOckmG6b1rDruCN9 2hoBArsVve4vTsWRwqxo4cgSXnbIZSUGzbYkOuLS8KUinGmIeyDyCh0nj5kE6Wrn0ePH 6tqc7Ku6lYw32sNyd0wrlcbSo0HaUT61e3DThbvc5pV8EkDBSts9eu3ooH/D89JZIUOz AJmls8mcKJuSm2ge/YBvJp4kr21IU8H3zUimLKMOhQJAXRMuvBEXgH/1PtwuHKpKHFDd igIQeK+W+YCSY7q3k/vxYsN4mslcp00QmpYTBek9iBJxPLkyF4DEq9CospV0BXDW3+rr qQZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791532983; x=1792137783; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=abrjBZtqWK4ithY2rB/XsxNJwm1DdDO75e5ZEpU8VL4=; b=uZGiR7yDpeHsIxf1a+a+LSlbZFC8D4X/FifZAukjGu/CfUKbBvgN8AMODPaw2jqlz3 oT3nDsL6sgpVkw7UXxXOWiwk1v5eHHYPqCrKlgiLzPGekbz/pzt418o917YSNbZllY6y LZgJrpZ9yIy2VVSp3NmfdLRc5zVi2ECsmKFLq2HMKAWN4jIcrIg+hhqxWRsVFLaC9gtr VcGsFOfJUVI3ahxTFI6NXpxRe4CySJ60PE75RyhCnSvf5ptAF/7/5BAESIDj9qtHwVZy +HsYyXdRhfJ0ro7oKewnB3tnVD3jykOwNtrIj/ClZMvgla/l+R2E7Zlpn6aoW7MOUaii iLOQ== X-Forwarded-Encrypted: i=1; AKwUvByBbKd7g++NKd0VioTduzU0pvt2Y2kLTxsVTEGWCVXbwYX97+6C36x5WVeDG3k2p4+4TVkw48sbj5UOV6k=@vger.kernel.org X-Gm-Message-State: AFuF++m8Fo7biGkIjKLfo5Q7SKeOm9043TGnkjhs+ri4f9cl/HLAypCx lJiw7sFU5A798oUGvMXPOvq9aMOowQ8J/lvO2q4IAKrdSMR4AHoFy189QUcTLCu7EIYsCw== X-Gm-Gg: AYBFou1deMOcVLOu7dEd5WMhS20u0BVl/+PlcFV+PboPRDV8qigI7e9KryG2ICvhHPe +UAbggazKiNNKh0ydGJFSMg1n+McYDgnwzg6gLZHXCFSZS0JJj72eDIeKcl25FrAIFBike7Z1ew aVkr5qhBtvGsJvuD7Ke4LcJZH+4wgS3cQdC803ORr0LdLbiZYav8FfxGNgHpeFMIyP0OkIaJFn+ 8LvgxktIZC7NeqAtxVIcjmGDxFEAPncKH1I1j5bONmqKUibAbpjIeSu2y77K5gJAfd1y+cBPG4q GMq93juKxvWw5tL1Kr2yjGbzVgx/ruWfYosgiZ2s02hlryJGN42tob0gYnfDobf9e8YHes5heJ6 EDIvK7sh7HjqFRH21nBy383YnJqI7s1JrzpJUN914maKuEEkShYNneopiY9SdozUcWEzIRCt7L+ hE54pOO6W/nVVJ69MgvOSm+QgLFZ4eONYhkjOubwr3SqCEr9dz6VzevVPXs/yKKaQKMgZEc062v jBGT0XWcv8rhIbJxt/3bEWzJB6ms1ZqQL/4 X-Received: by 2002:a05:6830:449f:b0:816:a9dc:6d05 with SMTP id 46e09a7af769-83090b2e4b5mr856599a34.4.1791532983102; Fri, 09 Oct 2026 01:03:03 -0700 (PDT) Received: from localhost.localdomain ([14.22.11.166]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-83039d385dcsm1199706a34.21.2026.10.09.01.02.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 09 Oct 2026 01:03:00 -0700 (PDT) From: Henry Martin To: Paulo Alcantara , Namjae Jeon , Ronnie Sahlberg , Shyam Prasad N , Tom Talpey , Bharath SM , Steve French Cc: linux-cifs@vger.kernel.org, linux-kernel@vger.kernel.org, Henry Martin , stable@vger.kernel.org Subject: [PATCH] cifs: fix use-after-free of server info on cifs_ses_add_channel error Date: Fri, 9 Oct 2026 16:02:52 +0800 Message-ID: <20261009080252.2805877-1-bsdhenrymartin@gmail.com> X-Mailer: git-send-email 2.43.7 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The error path of cifs_ses_add_channel() calls cifs_put_tcp_session() before cifs_chan_clear_need_reconnect(). The latter reaches cifs_ses_get_chan_index(), which dereferences server->terminate; if the put was the final reference, TCP_Server_Info is already freed and this is a use-after-free. Same put-then-use pattern as the recently fixed sibling in commit 717e0a25036b6. Reorder: clear the reconnect bit and drop chan_count under chan_lock first, release the server reference last. This vulnerability was discovered by Tencent CodeBuddy Security. Cc: stable@vger.kernel.org Fixes: ee1d21794e55a ("cifs: handle when server stops supporting multichannel") Signed-off-by: Henry Martin --- fs/smb/client/sess.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c index e095f41b5882..650c0f855a29 100644 --- a/fs/smb/client/sess.c +++ b/fs/smb/client/sess.c @@ -626,12 +626,16 @@ cifs_ses_add_channel(struct cifs_ses *ses, out: if (rc && chan->server) { - cifs_put_tcp_session(chan->server, 0); - spin_lock(&ses->chan_lock); - /* we rely on all bits beyond chan_count to be clear */ + /* Clear the reconnect bitmask BEFORE dropping the server + * reference: cifs_ses_get_chan_index() dereferences + * server->terminate, and cifs_put_tcp_session() may be the + * final put that frees chan->server (use-after-free). + */ cifs_chan_clear_need_reconnect(ses, chan->server); + + /* we rely on all bits beyond chan_count to be clear */ ses->chan_count--; /* * chan_count should never reach 0 as at least the primary @@ -639,6 +643,8 @@ cifs_ses_add_channel(struct cifs_ses *ses, */ WARN_ON(ses->chan_count < 1); spin_unlock(&ses->chan_lock); + + cifs_put_tcp_session(chan->server, 0); } kfree(ctx->UNC); -- 2.43.7