[PATCH v3] ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

[PATCH v3] ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

[Werner Kasselman]

smb_grant_oplock() has two issues in the oplock publication sequence:

1) opinfo is linked into ci->m_op_list (via opinfo_add) before
   add_lease_global_list() is called.  If add_lease_global_list()
   fails (kmalloc returns NULL), the error path frees the opinfo
   via __free_opinfo() while it is still linked in ci->m_op_list.
   Concurrent m_op_list readers (opinfo_get_list, or direct iteration
   in smb_break_all_levII_oplock) dereference the freed node.

2) opinfo->o_fp is assigned after add_lease_global_list() publishes
   the opinfo on the global lease list.  A concurrent
   find_same_lease_key() can walk the lease list and dereference
   opinfo->o_fp->f_ci while o_fp is still NULL.

Fix by restructuring the publication sequence to eliminate post-publish
failure:

- Set opinfo->o_fp before any list publication (fixes NULL deref).
- Preallocate lease_table via alloc_lease_table() before opinfo_add()
  so add_lease_global_list() becomes infallible after publication.
- Keep the original m_op_list publication order (opinfo_add before
  lease list) so concurrent opens via same_client_has_lease() and
  opinfo_get_list() still see the in-flight grant.
- Use opinfo_put() instead of __free_opinfo() on err_out so that
  the RCU-deferred free path is used.

This also requires splitting add_lease_global_list() to take a
preallocated lease_table and changing its return type from int to void,
since it can no longer fail.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Fixes: 1dfd062caa16 ("ksmbd: fix use-after-free by using call_rcu() for oplock_info")
Cc: stable@vger.kernel.org
Signed-off-by: Werner Kasselman <werner@verivus.com>
---
 fs/smb/server/oplock.c | 72 ++++++++++++++++++++++++++----------------
 1 file changed, 45 insertions(+), 27 deletions(-)

diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c
index 393a4ae47cc1..9b2bb8764a80 100644
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -82,11 +82,19 @@ static void lease_del_list(struct oplock_info *opinfo)
 	spin_unlock(&lb->lb_lock);
 }
 
-static void lb_add(struct lease_table *lb)
+static struct lease_table *alloc_lease_table(struct oplock_info *opinfo)
 {
-	write_lock(&lease_list_lock);
-	list_add(&lb->l_entry, &lease_table_list);
-	write_unlock(&lease_list_lock);
+	struct lease_table *lb;
+
+	lb = kmalloc_obj(struct lease_table, KSMBD_DEFAULT_GFP);
+	if (!lb)
+		return NULL;
+
+	memcpy(lb->client_guid, opinfo->conn->ClientGUID,
+	       SMB2_CLIENT_GUID_SIZE);
+	INIT_LIST_HEAD(&lb->lease_list);
+	spin_lock_init(&lb->lb_lock);
+	return lb;
 }
 
 static int alloc_lease(struct oplock_info *opinfo, struct lease_ctx_info *lctx)
@@ -1042,34 +1050,27 @@ static void copy_lease(struct oplock_info *op1, struct oplock_info *op2)
 	lease2->version = lease1->version;
 }
 
-static int add_lease_global_list(struct oplock_info *opinfo)
+static void add_lease_global_list(struct oplock_info *opinfo,
+				  struct lease_table *new_lb)
 {
 	struct lease_table *lb;
 
-	read_lock(&lease_list_lock);
+	write_lock(&lease_list_lock);
 	list_for_each_entry(lb, &lease_table_list, l_entry) {
 		if (!memcmp(lb->client_guid, opinfo->conn->ClientGUID,
 			    SMB2_CLIENT_GUID_SIZE)) {
 			opinfo->o_lease->l_lb = lb;
 			lease_add_list(opinfo);
-			read_unlock(&lease_list_lock);
-			return 0;
+			write_unlock(&lease_list_lock);
+			kfree(new_lb);
+			return;
 		}
 	}
-	read_unlock(&lease_list_lock);
 
-	lb = kmalloc_obj(struct lease_table, KSMBD_DEFAULT_GFP);
-	if (!lb)
-		return -ENOMEM;
-
-	memcpy(lb->client_guid, opinfo->conn->ClientGUID,
-	       SMB2_CLIENT_GUID_SIZE);
-	INIT_LIST_HEAD(&lb->lease_list);
-	spin_lock_init(&lb->lb_lock);
-	opinfo->o_lease->l_lb = lb;
+	opinfo->o_lease->l_lb = new_lb;
 	lease_add_list(opinfo);
-	lb_add(lb);
-	return 0;
+	list_add(&new_lb->l_entry, &lease_table_list);
+	write_unlock(&lease_list_lock);
 }
 
 static void set_oplock_level(struct oplock_info *opinfo, int level,
@@ -1189,6 +1190,7 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid,
 	int err = 0;
 	struct oplock_info *opinfo = NULL, *prev_opinfo = NULL;
 	struct ksmbd_inode *ci = fp->f_ci;
+	struct lease_table *new_lb = NULL;
 	bool prev_op_has_lease;
 	__le32 prev_op_state = 0;
 
@@ -1291,21 +1293,37 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid,
 	set_oplock_level(opinfo, req_op_level, lctx);
 
 out:
-	opinfo_count_inc(fp);
-	opinfo_add(opinfo, fp);
-
+	/*
+	 * Set o_fp before any publication so that concurrent readers
+	 * (e.g. find_same_lease_key() on the lease list) that
+	 * dereference opinfo->o_fp don't hit a NULL pointer.
+	 *
+	 * Keep the original publication order so concurrent opens can
+	 * still observe the in-flight grant via ci->m_op_list, but make
+	 * everything after opinfo_add() no-fail by preallocating any new
+	 * lease_table first.
+	 */
+	opinfo->o_fp = fp;
 	if (opinfo->is_lease) {
-		err = add_lease_global_list(opinfo);
-		if (err)
+		new_lb = alloc_lease_table(opinfo);
+		if (!new_lb) {
+			err = -ENOMEM;
 			goto err_out;
+		}
 	}
 
+	opinfo_count_inc(fp);
+	opinfo_add(opinfo, fp);
+
+	if (opinfo->is_lease)
+		add_lease_global_list(opinfo, new_lb);
+
 	rcu_assign_pointer(fp->f_opinfo, opinfo);
-	opinfo->o_fp = fp;
 
 	return 0;
 err_out:
-	__free_opinfo(opinfo);
+	kfree(new_lb);
+	opinfo_put(opinfo);
 	return err;
 }
 
-- 
2.43.0

Re: [PATCH v3] ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

[ChenXiaoSong]

Looks good to me so far. Others can continue the review.

Thanks,
ChenXiaoSong <chenxiaosong@kylinos.cn>

On 3/17/26 14:52, Werner Kasselman wrote:
> smb_grant_oplock() has two issues in the oplock publication sequence:
> 
> 1) opinfo is linked into ci->m_op_list (via opinfo_add) before
>     add_lease_global_list() is called.  If add_lease_global_list()
>     fails (kmalloc returns NULL), the error path frees the opinfo
>     via __free_opinfo() while it is still linked in ci->m_op_list.
>     Concurrent m_op_list readers (opinfo_get_list, or direct iteration
>     in smb_break_all_levII_oplock) dereference the freed node.
> 
> 2) opinfo->o_fp is assigned after add_lease_global_list() publishes
>     the opinfo on the global lease list.  A concurrent
>     find_same_lease_key() can walk the lease list and dereference
>     opinfo->o_fp->f_ci while o_fp is still NULL.
> 
> Fix by restructuring the publication sequence to eliminate post-publish
> failure:
> 
> - Set opinfo->o_fp before any list publication (fixes NULL deref).
> - Preallocate lease_table via alloc_lease_table() before opinfo_add()
>    so add_lease_global_list() becomes infallible after publication.
> - Keep the original m_op_list publication order (opinfo_add before
>    lease list) so concurrent opens via same_client_has_lease() and
>    opinfo_get_list() still see the in-flight grant.
> - Use opinfo_put() instead of __free_opinfo() on err_out so that
>    the RCU-deferred free path is used.
> 
> This also requires splitting add_lease_global_list() to take a
> preallocated lease_table and changing its return type from int to void,
> since it can no longer fail.
> 
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Fixes: 1dfd062caa16 ("ksmbd: fix use-after-free by using call_rcu() for oplock_info")
> Cc: stable@vger.kernel.org
> Signed-off-by: Werner Kasselman <werner@verivus.com>

Re: [PATCH v3] ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

[Steve French]

I see some AI review comments from Sashiko:
https://sashiko.dev/#/patchset/20260317065253.1743552-1-werner%40verivus.com

On Tue, Mar 17, 2026 at 3:17 AM ChenXiaoSong
<chenxiaosong@chenxiaosong.com> wrote:
>
> Looks good to me so far. Others can continue the review.
>
> Thanks,
> ChenXiaoSong <chenxiaosong@kylinos.cn>
>
> On 3/17/26 14:52, Werner Kasselman wrote:
> > smb_grant_oplock() has two issues in the oplock publication sequence:
> >
> > 1) opinfo is linked into ci->m_op_list (via opinfo_add) before
> >     add_lease_global_list() is called.  If add_lease_global_list()
> >     fails (kmalloc returns NULL), the error path frees the opinfo
> >     via __free_opinfo() while it is still linked in ci->m_op_list.
> >     Concurrent m_op_list readers (opinfo_get_list, or direct iteration
> >     in smb_break_all_levII_oplock) dereference the freed node.
> >
> > 2) opinfo->o_fp is assigned after add_lease_global_list() publishes
> >     the opinfo on the global lease list.  A concurrent
> >     find_same_lease_key() can walk the lease list and dereference
> >     opinfo->o_fp->f_ci while o_fp is still NULL.
> >
> > Fix by restructuring the publication sequence to eliminate post-publish
> > failure:
> >
> > - Set opinfo->o_fp before any list publication (fixes NULL deref).
> > - Preallocate lease_table via alloc_lease_table() before opinfo_add()
> >    so add_lease_global_list() becomes infallible after publication.
> > - Keep the original m_op_list publication order (opinfo_add before
> >    lease list) so concurrent opens via same_client_has_lease() and
> >    opinfo_get_list() still see the in-flight grant.
> > - Use opinfo_put() instead of __free_opinfo() on err_out so that
> >    the RCU-deferred free path is used.
> >
> > This also requires splitting add_lease_global_list() to take a
> > preallocated lease_table and changing its return type from int to void,
> > since it can no longer fail.
> >
> > Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> > Fixes: 1dfd062caa16 ("ksmbd: fix use-after-free by using call_rcu() for oplock_info")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Werner Kasselman <werner@verivus.com>



-- 
Thanks,

Steve

RE: [PATCH v3] ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

[Werner Kasselman]

Hi Steve,

Thanks for flagging. I reviewed the Sashiko comments, here's a summary:

1) UAF risk on fp from earlier assignment, not a concern. The caller (smb2_open) holds a reference to fp throughout smb_grant_oplock(), so it cannot be freed during execution.

2) RCU locking in lease list iteration (find_same_lease_key, lookup_lease_in_table dropping rcu_read_unlock mid-traversal). This is a pre-existing pattern, not introduced by this patch. Worth a separate audit but out of scope for this fix imho.

3) NULL deref window on opinfo->o_fp: This is exactly the bug this patch fixes, i.e. concurrent readers could see opinfo on the lease list before o_fp was assigned.

4) Reference count management in error paths: opinfo_put() usage is unchanged by this patch. The reordering moves o_fp assignment before list publication but doesn't change refcount semantics.

Points 1, 2, and 4 are either false positives or pre-existing patterns outside the scope of this fix, happy to be corrected though.

Werner

-----Original Message-----
From: Steve French <smfrench@gmail.com> 
Sent: Wednesday, 18 March 2026 7:27 AM
To: ChenXiaoSong <chenxiaosong@chenxiaosong.com>
Cc: Werner Kasselman <werner@verivus.ai>; linux-cifs@vger.kernel.org; linkinjeon@kernel.org; senozhatsky@chromium.org; linux-kernel@vger.kernel.org; stable@vger.kernel.org
Subject: Re: [PATCH v3] ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

I see some AI review comments from Sashiko:
https://sashiko.dev/#/patchset/20260317065253.1743552-1-werner%40verivus.com

On Tue, Mar 17, 2026 at 3:17 AM ChenXiaoSong <chenxiaosong@chenxiaosong.com> wrote:
>
> Looks good to me so far. Others can continue the review.
>
> Thanks,
> ChenXiaoSong <chenxiaosong@kylinos.cn>
>
> On 3/17/26 14:52, Werner Kasselman wrote:
> > smb_grant_oplock() has two issues in the oplock publication sequence:
> >
> > 1) opinfo is linked into ci->m_op_list (via opinfo_add) before
> >     add_lease_global_list() is called.  If add_lease_global_list()
> >     fails (kmalloc returns NULL), the error path frees the opinfo
> >     via __free_opinfo() while it is still linked in ci->m_op_list.
> >     Concurrent m_op_list readers (opinfo_get_list, or direct iteration
> >     in smb_break_all_levII_oplock) dereference the freed node.
> >
> > 2) opinfo->o_fp is assigned after add_lease_global_list() publishes
> >     the opinfo on the global lease list.  A concurrent
> >     find_same_lease_key() can walk the lease list and dereference
> >     opinfo->o_fp->f_ci while o_fp is still NULL.
> >
> > Fix by restructuring the publication sequence to eliminate 
> > post-publish
> > failure:
> >
> > - Set opinfo->o_fp before any list publication (fixes NULL deref).
> > - Preallocate lease_table via alloc_lease_table() before opinfo_add()
> >    so add_lease_global_list() becomes infallible after publication.
> > - Keep the original m_op_list publication order (opinfo_add before
> >    lease list) so concurrent opens via same_client_has_lease() and
> >    opinfo_get_list() still see the in-flight grant.
> > - Use opinfo_put() instead of __free_opinfo() on err_out so that
> >    the RCU-deferred free path is used.
> >
> > This also requires splitting add_lease_global_list() to take a 
> > preallocated lease_table and changing its return type from int to 
> > void, since it can no longer fail.
> >
> > Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> > Fixes: 1dfd062caa16 ("ksmbd: fix use-after-free by using call_rcu() 
> > for oplock_info")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Werner Kasselman <werner@verivus.com>



--
Thanks,

Steve

Re: [PATCH v3] ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

[Namjae Jeon]

On Tue, Mar 17, 2026 at 3:53 PM Werner Kasselman <werner@verivus.ai> wrote:
>
> smb_grant_oplock() has two issues in the oplock publication sequence:
>
> 1) opinfo is linked into ci->m_op_list (via opinfo_add) before
>    add_lease_global_list() is called.  If add_lease_global_list()
>    fails (kmalloc returns NULL), the error path frees the opinfo
>    via __free_opinfo() while it is still linked in ci->m_op_list.
>    Concurrent m_op_list readers (opinfo_get_list, or direct iteration
>    in smb_break_all_levII_oplock) dereference the freed node.
>
> 2) opinfo->o_fp is assigned after add_lease_global_list() publishes
>    the opinfo on the global lease list.  A concurrent
>    find_same_lease_key() can walk the lease list and dereference
>    opinfo->o_fp->f_ci while o_fp is still NULL.
>
> Fix by restructuring the publication sequence to eliminate post-publish
> failure:
>
> - Set opinfo->o_fp before any list publication (fixes NULL deref).
> - Preallocate lease_table via alloc_lease_table() before opinfo_add()
>   so add_lease_global_list() becomes infallible after publication.
> - Keep the original m_op_list publication order (opinfo_add before
>   lease list) so concurrent opens via same_client_has_lease() and
>   opinfo_get_list() still see the in-flight grant.
> - Use opinfo_put() instead of __free_opinfo() on err_out so that
>   the RCU-deferred free path is used.
>
> This also requires splitting add_lease_global_list() to take a
> preallocated lease_table and changing its return type from int to void,
> since it can no longer fail.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Fixes: 1dfd062caa16 ("ksmbd: fix use-after-free by using call_rcu() for oplock_info")
> Cc: stable@vger.kernel.org
> Signed-off-by: Werner Kasselman <werner@verivus.com>
Applied it to #ksmbd-for-next-next.
Thanks!