[PATCH] smb: client: cancel reconnect work in clean_demultiplex_info()

[PATCH] smb: client: cancel reconnect work in clean_demultiplex_info()

[Paulo Alcantara]

clean_demultiplex_info() cancels server->echo delayed work but not
server->reconnect, which can cause a use-after-free when the
demultiplex thread exits while a reconnect work is still queued:

  cifs_demultiplex_thread()
    cifs_readv_from_socket()
      cifs_reconnect()
        __cifs_reconnect()
          cifs_queue_server_reconn()
            mod_delayed_work(cifsiod_wq, &server->reconnect, 0)
    clean_demultiplex_info()
      cancel_delayed_work_sync(&server->echo)   // echo canceled
                                                 // reconnect NOT canceled
      kfree_sensitive(server)                    // server freed

  ...later, on cifsiod_wq:

  smb2_reconnect_server()
    server->srv_count  // UAF read of freed server

Fix this by canceling server->reconnect delayed work in
clean_demultiplex_info() before the server is freed, the same way
cifs_put_tcp_session() already does.

Reported-by: syzbot+5003556314abc915a71f@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/6aa4a12d.f81106d8.2ab401.0023.GAE@google.com
Fixes: 53e0e11efe92 ("CIFS: Fix a possible memory corruption during reconnect")
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: David Howells <dhowells@redhat.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: stable@vger.kernel.org
---
 fs/smb/client/connect.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index b6e98eb31673..bef710d9a3c3 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -1067,6 +1067,7 @@ clean_demultiplex_info(struct TCP_Server_Info *server)
 	spin_unlock(&server->srv_lock);
 
 	cancel_delayed_work_sync(&server->echo);
+	cancel_delayed_work_sync(&server->reconnect);
 
 	spin_lock(&server->srv_lock);
 	server->tcpStatus = CifsExiting;
-- 
2.55.0

Re: [PATCH] smb: client: cancel reconnect work in clean_demultiplex_info()

[Namjae Jeon]

On Sun, Sep 13, 2026 at 12:20 AM Paulo Alcantara <pc@manguebit.org> wrote:
>
> clean_demultiplex_info() cancels server->echo delayed work but not
> server->reconnect, which can cause a use-after-free when the
> demultiplex thread exits while a reconnect work is still queued:
>
>   cifs_demultiplex_thread()
>     cifs_readv_from_socket()
>       cifs_reconnect()
>         __cifs_reconnect()
>           cifs_queue_server_reconn()
>             mod_delayed_work(cifsiod_wq, &server->reconnect, 0)
>     clean_demultiplex_info()
>       cancel_delayed_work_sync(&server->echo)   // echo canceled
>                                                  // reconnect NOT canceled
>       kfree_sensitive(server)                    // server freed
>
>   ...later, on cifsiod_wq:
>
>   smb2_reconnect_server()
>     server->srv_count  // UAF read of freed server
>
> Fix this by canceling server->reconnect delayed work in
> clean_demultiplex_info() before the server is freed, the same way
> cifs_put_tcp_session() already does.
>
> Reported-by: syzbot+5003556314abc915a71f@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/r/6aa4a12d.f81106d8.2ab401.0023.GAE@google.com
> Fixes: 53e0e11efe92 ("CIFS: Fix a possible memory corruption during reconnect")
> Signed-off-by: Paulo Alcantara <pc@manguebit.org>
> Cc: David Howells <dhowells@redhat.com>
> Cc: Shyam Prasad N <sprasad@microsoft.com>
> Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
> Cc: Tom Talpey <tom@talpey.com>
> Cc: Bharath SM <bharathsm@microsoft.com>
> Cc: Namjae Jeon <linkinjeon@kernel.org>
> Cc: stable@vger.kernel.org
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Thanks!

Re: [PATCH] smb: client: cancel reconnect work in clean_demultiplex_info()

[Paulo Alcantara]

Paulo Alcantara <pc@manguebit.org> writes:

> clean_demultiplex_info() cancels server->echo delayed work but not
> server->reconnect, which can cause a use-after-free when the
> demultiplex thread exits while a reconnect work is still queued:
>
>   cifs_demultiplex_thread()
>     cifs_readv_from_socket()
>       cifs_reconnect()
>         __cifs_reconnect()
>           cifs_queue_server_reconn()
>             mod_delayed_work(cifsiod_wq, &server->reconnect, 0)
>     clean_demultiplex_info()
>       cancel_delayed_work_sync(&server->echo)   // echo canceled
>                                                  // reconnect NOT canceled
>       kfree_sensitive(server)                    // server freed
>
>   ...later, on cifsiod_wq:
>
>   smb2_reconnect_server()
>     server->srv_count  // UAF read of freed server
>
> Fix this by canceling server->reconnect delayed work in
> clean_demultiplex_info() before the server is freed, the same way
> cifs_put_tcp_session() already does.
> ...

Applied.