[PATCH] ksmbd: stop transports before procfs cleanup during shutdown

[PATCH] ksmbd: stop transports before procfs cleanup during shutdown

[DaeMyung Kang]

ksmbd_server_shutdown() removes the whole /proc/fs/ksmbd subtree via
ksmbd_proc_cleanup() before ksmbd_conn_transport_destroy() runs.  The
transport teardown later calls delete_proc_clients(), which removes the
cached proc_clients entry under that subtree.

Since proc_remove(ksmbd_proc_fs) already removes the subtree, that later
proc_remove(proc_clients) can operate on a freed proc_dir_entry and trip
KASAN during rmmod:

  BUG: KASAN: slab-use-after-free in proc_remove
  proc_remove
  ksmbd_conn_transport_destroy
  ksmbd_server_exit

Keep the control sysfs class unregistered before tearing down transports
so kill_server cannot race a module-exit cleanup, but stop the transports
before removing the root procfs subtree.  That lets client and session
proc entries be removed while their parent is still alive, then
ksmbd_proc_cleanup() can remove the remaining root entries.

KASAN testing confirms the ordering issue: the pre-fix module
reproduces the proc_remove slab-use-after-free during rmmod, while the
patched module passes the same rmmod scenario.  Active pending-IO
testing also passes; the observed workqueue hog warning is present on
the pre-fix baseline as well and is not introduced by this shutdown
ordering change.

Fixes: b38f99c1217a ("ksmbd: add procfs interface for runtime monitoring and statistics")
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
---
 fs/smb/server/server.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index 5d799b2d4c62..188a6a72f7fa 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -535,11 +535,11 @@ static int ksmbd_server_shutdown(void)
 {
 	WRITE_ONCE(server_conf.state, SERVER_STATE_SHUTTING_DOWN);
 
-	ksmbd_proc_cleanup();
 	class_unregister(&ksmbd_control_class);
+	ksmbd_conn_transport_destroy();
+	ksmbd_proc_cleanup();
 	ksmbd_workqueue_destroy();
 	ksmbd_ipc_release();
-	ksmbd_conn_transport_destroy();
 	ksmbd_crypto_destroy();
 	ksmbd_free_global_file_table();
 	destroy_lease_table(NULL);
-- 
2.43.0