From: Paulo Alcantara <pc@manguebit.org>
To: Fredric Cover <fredric.cover.lkernel@gmail.com>,
Namjae Jeon <linkinjeon@kernel.org>
Cc: ChenXiaoSong <chenxiaosong@chenxiaosong.com>,
Tom Talpey <tom@talpey.com>,
Ronnie Sahlberg <ronniesahlberg@gmail.com>,
Shyam Prasad N <sprasad@microsoft.com>,
Bharath SM <bharathsm@microsoft.com>,
linux-cifs@vger.kernel.org, linux-kernel@vger.kernel.org,
Fredric Cover <fredric.cover.lkernel@gmail.com>
Subject: Re: [PATCH] smb: client: fix early procfs exposure race
Date: Sun, 25 Oct 2026 15:13:05 -0300 [thread overview]
Message-ID: <384d3d0e29fe24571b92099ddfc05944@manguebit.org> (raw)
In-Reply-To: <20261022215506.31619-1-fredric.cover.lkernel@gmail.com>
Fredric Cover <fredric.cover.lkernel@gmail.com> writes:
> Currently, init_cifs() calls cifs_proc_init() near the beginning of
> the function, before INIT_LIST_HEAD, leading to a momentarily
> uninitialized, but exposed, procfs. If a userspace process reads this
> empty procfs, iterating over a zeroed list_head leads to a NULL
> pointer dereference and a kernel oops/panic.
>
> For example, if a delay is added between cifs_proc_init() and
> INIT_LIST_HEAD, and a userspace process is polling
> /proc/fs/cifs/DebugData, the following oops occurs:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000608
> PGD 0 P4D 0
> Oops: Oops: 0000 [#1] SMP PTI
> CPU: 0 UID: 0 PID: 3477 Comm: cat Not tainted 7.3.0-02212-g4df4d2a577db-dirty #6 PREEMPT(lazy)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 2025.11-3ubuntu7.3 09/23/2026
> RIP: 0010:cifs_debug_data_proc_show+0x103/0xd80 [cifs]
> Code: 00 31 d2 eb 25 48 89 df 48 c7 c6 4b d4 67 c0 e8 a3 12 f5 cb 48 8b 54 24 28 48 8b 6d 00 48 81 fd 28 3b 60 c0 0f 84 34 0c 00 00 <48> 83 bd 08 06 00 00 00 75 e5 ff c2 48 8b
> 4d 38 48 89 df 48 c7 c6
> RSP: 0018:ffffb603c03c7c38 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: ffff950240d3f2a0 RCX: 0000000000000001
> RDX: 0000000000000000 RSI: ffffffffc0672ab7 RDI: ffffffffc0603ad8
> RBP: 0000000000000000 R08: 737265767265530a R09: 203a737265767265
> R10: 6552205346562065 R11: 203a737473657571 R12: 0000000000000000
> R13: ffffb603c03c7d68 R14: ffff950240d3f2a0 R15: 0000000000000001
> FS: 00007fdae19d9b00(0000) GS:ffff95032d4bb000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000608 CR3: 000000010638e001 CR4: 0000000000370ef0
> Call Trace:
> <TASK>
> ? seq_read_iter+0x86/0x400
> ? seq_read_iter+0x86/0x400
> seq_read_iter+0x183/0x400
> proc_reg_read_iter+0x62/0x90
> copy_splice_read+0x215/0x310
> splice_file_to_pipe+0xec/0x1c0
> do_splice+0x4b8/0x780
> __se_sys_splice+0x18f/0x250
> do_syscall_64+0x109/0x330
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> </TASK>
>
> Fix this by moving cifs_proc_init() down in init_cifs(), ensuring it runs
> only after all internal lists, locks, counters, and workqueues are fully
> ready, but before registering the filesystem. Update the error cleanup
> ladder and exit_cifs() to maintain proper LIFO order.
> ...
Applied.
prev parent reply other threads:[~2026-10-25 18:13 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-22 21:55 Fredric Cover
2026-10-25 18:13 ` Paulo Alcantara [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=384d3d0e29fe24571b92099ddfc05944@manguebit.org \
--to=pc@manguebit.org \
--cc=bharathsm@microsoft.com \
--cc=chenxiaosong@chenxiaosong.com \
--cc=fredric.cover.lkernel@gmail.com \
--cc=linkinjeon@kernel.org \
--cc=linux-cifs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ronniesahlberg@gmail.com \
--cc=sprasad@microsoft.com \
--cc=tom@talpey.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®