diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2026-03-02 12:55:02 +0900 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2026-03-08 21:28:39 -0500 |
| commit | eac3361e3d5dd8067b3258c69615888eb45e9f25 (patch) | |
| tree | 6f7dd6cdc9767fe52894d1b53432969f90f8d24c /fs/smb | |
| parent | 1dfd062caa165ec9d7ee0823087930f3ab8a6294 (diff) | |
| download | linux-next-eac3361e3d5dd8067b3258c69615888eb45e9f25.tar.gz linux-next-eac3361e3d5dd8067b3258c69615888eb45e9f25.zip | |
ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()
opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is being
accessed after rcu_read_unlock() has been called. This creates a
race condition where the memory could be freed by a concurrent
writer between the unlock and the subsequent pointer dereferences
(opinfo->is_lease, etc.), leading to a use-after-free.
Fixes: 5fb282ba4fef ("ksmbd: fix possible null-deref in smb_lazy_parent_lease_break_close")
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/smb')
| -rw-r--r-- | fs/smb/server/oplock.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c index 8c9aa17384f3..393a4ae47cc1 100644 --- a/fs/smb/server/oplock.c +++ b/fs/smb/server/oplock.c @@ -1135,10 +1135,12 @@ void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp) rcu_read_lock(); opinfo = rcu_dereference(fp->f_opinfo); - rcu_read_unlock(); - if (!opinfo || !opinfo->is_lease || opinfo->o_lease->version != 2) + if (!opinfo || !opinfo->is_lease || opinfo->o_lease->version != 2) { + rcu_read_unlock(); return; + } + rcu_read_unlock(); p_ci = ksmbd_inode_lookup_lock(fp->filp->f_path.dentry->d_parent); if (!p_ci) |