diff options
| author | Eduard Zateev <hackerowskiy@gmail.com> | 2026-10-20 21:45:45 +0200 |
|---|---|---|
| committer | Paulo Alcantara <pc@manguebit.org> | 2026-10-25 15:04:06 -0300 |
| commit | 482c117c6dbeee382790168af10959810450ab09 (patch) | |
| tree | f643125a4b3ce7d7495a483346b90de6a3ef19f1 /tools/perf/scripts/python | |
| parent | f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc (diff) | |
| download | linux-482c117c6dbeee382790168af10959810450ab09.tar.gz linux-482c117c6dbeee382790168af10959810450ab09.zip | |
smb: client: hold server info until cifsd exits
The last session reference can be dropped while the cifsd demultiplex
thread is still running clean_demultiplex_info(). That thread frees
TCP_Server_Info there, racing with cifs_put_tcp_session() as it releases
the server crypto state. syzbot reported a KASAN use-after-free in
cifs_crypto_secmech_release().
Keep an object reference for the cifsd thread. Defer final crypto,
session-key, network namespace, string, and structure cleanup until both
the last session reference and the thread reference are dropped. Drop the
thread reference after clean_demultiplex_info() has finished using the
server.
Build-tested with ARCH=arm64 and W=1 for
fs/smb/client/connect.o. The KASAN reproducer was not run on the patched
kernel.
Fixes: a5c3e1c725af ("Revert "cifs: No need to send SIGKILL to demux_thread during umount"")
Reported-by: syzbot+5c3ed2a0de3270efc921@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5c3ed2a0de3270efc921
Reported-by: syzbot+c2ec61adfbcb24e5ec20@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=c2ec61adfbcb24e5ec20
Assisted-by: LLM OpenAI Codex
Signed-off-by: Eduard Zateev <hackerowskiy@gmail.com>
Cc: stable@vger.kernel.org
Tested-by: Michail Andreas Michalopoulos <mike.michalo@gmail.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions