Re: ksmbd: unlocked iface_list free during server reset vs FSCTL_QUERY_NETWORK_INTERFACE_INFO traversal -> use-after-free (kernel oops)

[Greg KH <greg@kroah.com>]

On Wed, Sep 23, 2026 at 04:47:44PM +0800, 朱浩 wrote:
> Hello,
> I would like to privately report a use-after-free vulnerability in the Linux kernel SMB
> server (ksmbd) that leads to a kernel oops (denial of service). The bug is present in the
> current upstream master as of this writing.
> -------------------------------------------------------------------
> Summary
> -------------------------------------------------------------------
> ksmbd frees the global interface list (iface_list) without any lock during server
> reset / hard-kill, *before* stop_sessions() is invoked. Meanwhile the
> FSCTL_QUERY_NETWORK_INTERFACE_INFO ioctl handler traverses that same list while holding
> only rtnl_lock (a lock the free path does not take), dereferencing freed iface nodes.
> A remote authenticated SMB client that floods FSCTL_QUERY_NETWORK_INTERFACE_INFO while the
> server is being reset can trigger a use-after-free read, producing a KASAN
> slab-use-after-free report and a general protection fault (kernel oops / DoS).
> -------------------------------------------------------------------
> Affected component and versions
> -------------------------------------------------------------------
> Component: Linux kernel, fs/smb/server (ksmbd)
> Confirmed present:
>   - Snapshot at commit af5226abb4 (6.15.0-rc3 era), where I reproduced it with KASAN.

That is very very very old and obsolete and known broken and buggy.
Please always test on the latest kernel version, hundreds, if not
thousands, of changes to the ksmbd code have happened since then.

>   - Current upstream master (checked 2026-09): ksmbd_tcp_destroy() still frees iface_list
>     without any lock, and ksmbd_find_netdev_name_iface_list() still traverses it holding
>     only rtnl_lock. No fix is present upstream as far as I can tell.

Please test to verify.

> Suggested fix
> -------------------------------------------------------------------
> Any of:
>   1. Protect iface_list with a dedicated lock shared by ksmbd_tcp_destroy() and
>      ksmbd_find_netdev_name_iface_list() (and all other traversers);
>   2. Free the nodes via RCU and traverse under rcu_read_lock();
>   3. Reorder ksmbd_conn_transport_destroy() to run stop_sessions() before freeing iface_list.

Please create a patch that can be applied to resolve the issue so that
you get full credit for this.

thanks,

greg k-h