Re: [PATCH] smb: client: cancel reconnect work in clean_demultiplex_info()

[Paulo Alcantara <pc@manguebit.org>]

Paulo Alcantara <pc@manguebit.org> writes:

> clean_demultiplex_info() cancels server->echo delayed work but not
> server->reconnect, which can cause a use-after-free when the
> demultiplex thread exits while a reconnect work is still queued:
>
>   cifs_demultiplex_thread()
>     cifs_readv_from_socket()
>       cifs_reconnect()
>         __cifs_reconnect()
>           cifs_queue_server_reconn()
>             mod_delayed_work(cifsiod_wq, &server->reconnect, 0)
>     clean_demultiplex_info()
>       cancel_delayed_work_sync(&server->echo)   // echo canceled
>                                                  // reconnect NOT canceled
>       kfree_sensitive(server)                    // server freed
>
>   ...later, on cifsiod_wq:
>
>   smb2_reconnect_server()
>     server->srv_count  // UAF read of freed server
>
> Fix this by canceling server->reconnect delayed work in
> clean_demultiplex_info() before the server is freed, the same way
> cifs_put_tcp_session() already does.
> ...

Applied.