Re: [PATCH] ksmbd: fix use-after-free in __ksmbd_close_fd() lock cleanup

ChenXiaoSong
2026-04-04T05:03:08Z

Hi Namjae and munan,

In `ksmbd_reopen_durable_fd()`, when -EBADF is returned, should
`list_del(&smb_lock->clist)` be called?

If my understanding is incorrect, please let me know.

>
> int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp)
> {
> ...
> fp->conn = conn;
> ...
>
> list_for_each_entry(smb_lock, &fp->lock_list, flist) {
> spin_lock(&conn->llist_lock);
> list_add_tail(&smb_lock->clist, &conn->lock_list);
> spin_unlock(&conn->llist_lock);
> }
> ...
> __open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID);
> if (!has_file_id(fp->volatile_id)) {
> fp->conn = NULL;
> fp->tcon = NULL;
> return -EBADF;
> }
> return 0;
> }

Thanks,
ChenXiaoSong <chenxiaosong@kylinos.cn>

On 4/4/26 10:28, Namjae Jeon wrote:
> I will apply the following patch instead of your patch. Let me know if
> I am missing something.
> https://github.com/smfrench/smb3-kernel/
> commit/319ca5432460b0749e420f7cff637dfbc7e16be3
> Thanks.