[PATCH] ksmbd: fix use-after-free of lease table in smb2_lease_break_noti()

[PATCH] ksmbd: fix use-after-free of lease table in smb2_lease_break_noti()

[Abdifatah Suruur]

smb2_lease_break_noti() redirects v2 lease break notifications to the
client lease channel by reading lease->l_lb->conn.  The lease table is
linked into the global lease_table_list and destroyed by
destroy_lease_table() on connection teardown, which unlinks it and
kfree()s it under write_lock(&lease_list_lock).

The break path dereferences lease->l_lb and lease->l_lb->conn without
holding lease_list_lock, so when the owning connection is torn down
concurrently (e.g. the client disconnects while another connection's
open triggers a lease break), the table can be freed between the load
and the dereference.  This is a use-after-free read of struct
lease_table; the stale conn pointer is then passed to
ksmbd_conn_releasing() and ksmbd_conn_get(), corrupting a refcount on
memory that may have been reallocated.

Take a conn reference and perform the lease-table lookup under
read_lock(&lease_list_lock), matching the lock discipline of
find_same_lease_key() and lookup_lease_in_table(), and transfer the
reference to the async work item instead of re-taking it.

Fixes: 2145945feb2c2 ("ksmbd: route v2 lease breaks on the client lease channel")
Cc: stable@vger.kernel.org
Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>

---
 fs/smb/server/oplock.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c
index 79787099afdc6..ac21583cb6222 100644
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -1007,20 +1007,27 @@ static int smb2_lease_break_noti(struct oplock_info *opinfo, bool wait_ack,
 	struct lease *lease = opinfo->o_lease;
 	int ret = 0;

-	conn = READ_ONCE(opinfo->conn);
+	conn = ksmbd_conn_get(READ_ONCE(opinfo->conn));
+	read_lock(&lease_list_lock);
 	if (lease->version == 2 && lease->l_lb && lease->l_lb->conn &&
-	    !ksmbd_conn_releasing(lease->l_lb->conn))
-		conn = lease->l_lb->conn;
+	    !ksmbd_conn_releasing(lease->l_lb->conn)) {
+		ksmbd_conn_put(conn);
+		conn = ksmbd_conn_get(lease->l_lb->conn);
+	}
+	read_unlock(&lease_list_lock);
 	if (!conn)
 		return ksmbd_invalidate_durable_fd(opinfo->fid);

 	work = ksmbd_alloc_work_struct();
-	if (!work)
+	if (!work) {
+		ksmbd_conn_put(conn);
 		return -ENOMEM;
+	}

 	br_info = kmalloc_obj(struct lease_break_info, KSMBD_DEFAULT_GFP);
 	if (!br_info) {
 		ksmbd_free_work_struct(work);
+		ksmbd_conn_put(conn);
 		return -ENOMEM;
 	}

@@ -1036,7 +1043,7 @@ static int smb2_lease_break_noti(struct oplock_info *opinfo, bool wait_ack,
 	memcpy(br_info->lease_key, lease->lease_key, SMB2_LEASE_KEY_SIZE);

 	work->request_buf = (char *)br_info;
-	work->conn = ksmbd_conn_get(conn);
+	work->conn = conn;
 	work->sess = opinfo->sess;

 	ksmbd_conn_r_count_inc(conn);

Re: [PATCH] ksmbd: fix use-after-free of lease table in smb2_lease_break_noti()

[Namjae Jeon]

On Wed, Aug 19, 2026 at 6:09 PM Abdifatah Suruur <suruurism@gmail.com> wrote:
>
> smb2_lease_break_noti() redirects v2 lease break notifications to the
> client lease channel by reading lease->l_lb->conn.  The lease table is
> linked into the global lease_table_list and destroyed by
> destroy_lease_table() on connection teardown, which unlinks it and
> kfree()s it under write_lock(&lease_list_lock).
>
> The break path dereferences lease->l_lb and lease->l_lb->conn without
> holding lease_list_lock, so when the owning connection is torn down
> concurrently (e.g. the client disconnects while another connection's
> open triggers a lease break), the table can be freed between the load
> and the dereference.  This is a use-after-free read of struct
> lease_table; the stale conn pointer is then passed to
> ksmbd_conn_releasing() and ksmbd_conn_get(), corrupting a refcount on
> memory that may have been reallocated.
>
> Take a conn reference and perform the lease-table lookup under
> read_lock(&lease_list_lock), matching the lock discipline of
> find_same_lease_key() and lookup_lease_in_table(), and transfer the
> reference to the async work item instead of re-taking it.
>
> Fixes: 2145945feb2c2 ("ksmbd: route v2 lease breaks on the client lease channel")
> Cc: stable@vger.kernel.org
> Signed-off-by: Abdifatah Suruur <suruurism@gmail.com>
We have a better patch below.

https://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git/commit/?h=ksmbd-for-next&id=3a98de41b0a4d80e0aa57f677f7592e5f5321613

Thanks.