[PATCH 6.1] smb: client: fix double free of TCP_Server_Info::hostname

[PATCH 6.1] smb: client: fix double free of TCP_Server_Info::hostname

[Pavel Paklov]

From: Pavel Paklov <pavel.paklov@cyberprotect.ru>

From: Paulo Alcantara <pc@manguebit.com>

commit fa2f9906a7b333ba757a7dbae0713d8a5396186e upstream

When shutting down the server in cifs_put_tcp_session(), cifsd thread
might be reconnecting to multiple DFS targets before it realizes it
should exit the loop, so @server->hostname can't be freed as long as
cifsd thread isn't done.  Otherwise the following can happen:

  RIP: 0010:__slab_free+0x223/0x3c0
  Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89
  1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f>
  0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80
  RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246
  RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068
  RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400
  RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000
  R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500
  R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068
  FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000)
  000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4:
  PKRU: 55555554
  Call Trace:
   <TASK>
   ? show_trace_log_lvl+0x1c4/0x2df
   ? show_trace_log_lvl+0x1c4/0x2df
   ? __reconnect_target_unlocked+0x3e/0x160 [cifs]
   ? __die_body.cold+0x8/0xd
   ? die+0x2b/0x50
   ? do_trap+0xce/0x120
   ? __slab_free+0x223/0x3c0
   ? do_error_trap+0x65/0x80
   ? __slab_free+0x223/0x3c0
   ? exc_invalid_op+0x4e/0x70
   ? __slab_free+0x223/0x3c0
   ? asm_exc_invalid_op+0x16/0x20
   ? __slab_free+0x223/0x3c0
   ? extract_hostname+0x5c/0xa0 [cifs]
   ? extract_hostname+0x5c/0xa0 [cifs]
   ? __kmalloc+0x4b/0x140
   __reconnect_target_unlocked+0x3e/0x160 [cifs]
   reconnect_dfs_server+0x145/0x430 [cifs]
   cifs_handle_standard+0x1ad/0x1d0 [cifs]
   cifs_demultiplex_thread+0x592/0x730 [cifs]
   ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
   kthread+0xdd/0x100
   ? __pfx_kthread+0x10/0x10
   ret_from_fork+0x29/0x50
   </TASK>

Fixes: 7be3248f3139 ("cifs: To match file servers, make sure the server hostname matches")
Reported-by: Jay Shin <jaeshin@redhat.com>
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Pavel Paklov <pavel.paklov@cyberprotect.ru>
---
Backport fix for CVE-2025-21673
 fs/smb/client/connect.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index 01ce81f77e89..2b0657fe2a3f 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -1066,6 +1066,7 @@ static void clean_demultiplex_info(struct TCP_Server_Info *server)
 	kfree(server->origin_fullpath);
 	kfree(server->leaf_fullpath);
 #endif
+	kfree(server->hostname);
 	kfree(server);
 
 	length = atomic_dec_return(&tcpSesAllocCount);
@@ -1688,8 +1689,6 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
 	kfree_sensitive(server->session_key.response);
 	server->session_key.response = NULL;
 	server->session_key.len = 0;
-	kfree(server->hostname);
-	server->hostname = NULL;
 
 	task = xchg(&server->tsk, NULL);
 	if (task)
-- 
2.43.0

Re: [PATCH 6.1] smb: client: fix double free of TCP_Server_Info::hostname

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: fa2f9906a7b333ba757a7dbae0713d8a5396186e

WARNING: Author mismatch between patch and upstream commit:
Backport author: Pavel Paklov<Pavel.Paklov@cyberprotect.ru>
Commit author: Paulo Alcantara<pc@manguebit.com>

Status in newer kernel trees:
6.14.y | Present (exact SHA1)
6.12.y | Present (different SHA1: a2be5f2ba34d)
6.6.y | Present (different SHA1: 1ea680703385)

Note: The patch differs from the upstream commit:
---
1:  fa2f9906a7b33 ! 1:  56e7a9b9b42bb smb: client: fix double free of TCP_Server_Info::hostname
    @@
      ## Metadata ##
    -Author: Paulo Alcantara <pc@manguebit.com>
    +Author: Pavel Paklov <pavel.paklov@cyberprotect.ru>
     
      ## Commit message ##
         smb: client: fix double free of TCP_Server_Info::hostname
     
    +    From: Paulo Alcantara <pc@manguebit.com>
    +
    +    commit fa2f9906a7b333ba757a7dbae0713d8a5396186e upstream
    +
         When shutting down the server in cifs_put_tcp_session(), cifsd thread
         might be reconnecting to multiple DFS targets before it realizes it
         should exit the loop, so @server->hostname can't be freed as long as
    @@ Commit message
         Reported-by: Jay Shin <jaeshin@redhat.com>
         Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
         Signed-off-by: Steve French <stfrench@microsoft.com>
    +    Signed-off-by: Pavel Paklov <pavel.paklov@cyberprotect.ru>
     
      ## fs/smb/client/connect.c ##
    -@@ fs/smb/client/connect.c: clean_demultiplex_info(struct TCP_Server_Info *server)
    - 	/* Release netns reference for this server. */
    - 	put_net(cifs_net_ns(server));
    +@@ fs/smb/client/connect.c: static void clean_demultiplex_info(struct TCP_Server_Info *server)
    + 	kfree(server->origin_fullpath);
      	kfree(server->leaf_fullpath);
    + #endif
     +	kfree(server->hostname);
      	kfree(server);
      
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |