From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CCEEF396B84 for ; Thu, 17 Sep 2026 03:56:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789617383; cv=none; b=ZwI50f9fDnFxa6zCNFe8DQCljIy97SW24YQf3B3vjR+a2VYvHyJQStAkCEyg3tuxJYhvf7a3nDnjcl0nhpzxoTtrvSGdCsQep7dUYO3Y+3WXpRhh7NFuPgqyCEJMC60HZLVKgejHCHe8tIvMte4y/Vub0GmCsQOObq1PIC7/Y2Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789617383; c=relaxed/simple; bh=wCpfUvoeRRSS5SozBlS5VjAz1chE9dV7f+bzzdZV85I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kpPOJQ30zQPgVDIoATZQaiFXg2FNfTIKZW/pI0Is3cfzbPZftM2oP7B4QmDwqsDRQcV+ahk2Gc4KjtBgtZ+hxe5M0UasaB+VvCoauxIbtdauBSBfExZUOrs9TxU2y7e1KAG1T9GnY4ELLB9mW77qvfBBRSYhiCKmM7t9pU/r31E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MR8B92Jb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MR8B92Jb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F3261F000FF; Thu, 17 Sep 2026 03:56:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789617380; bh=akfQBbdHIvMlPNsgD4OXEQ6SPZCAK6d2bpLEiz6BEDE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=MR8B92JbT/9zM+63sauu8a08X/x8hQkZ50mneAnXoh/zeSvXQwLf3uO6oQ+1gciO7 TsMvfPF9kkE+dvZzFmFpyWpOnKIrAkmngaRJSUCeISdWbjdDxTC2iVJSTPAciYdhWj lZz0OKa8dJRhfTupiLCTzVja2nbQGwLU+HNx7Ayyrh3Cj3dOVYBPNgPVZ2oVO0uERh le/JtJLkTtnWQg4pmm/0SbfDuOxZS8HuVRGLzJoXBbcHBWP+66S1PYFZfGKLDYsFq2 QjMYTzqn/GjLe1Pu5de7sFYpSOT161XUrfclZykMl110CmED5tk8Fb98M6eaWc2Fpi Qc9B6idL3XVMw== From: Sasha Levin To: stable@vger.kernel.org Cc: Karl Mehltretter , Paulo Alcantara , Sasha Levin Subject: [PATCH 6.1.y] smb: client: pin DFS superblock in iterator callback Date: Wed, 16 Sep 2026 23:56:18 -0400 Message-ID: <20260917035618.4121757-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026091643-unscathed-ocean-b2de@gregkh> References: <2026091643-unscathed-ocean-b2de@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Karl Mehltretter [ Upstream commit d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818 ] tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() takes its active reference only after iterate_supers_type() has dropped s_umount and its passive reference. Concurrent DFS automount expiry can therefore free the superblock before cifs_sb_active() uses it. A deterministic KASAN test reproduces the race as: BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80 The same test passes with this change applied. Take the active reference in the callback while iterate_supers_type() still holds s_umount shared. cifs_put_tcp_super() remains the matching release. Fixes: bacd704a95ad ("cifs: handle prefix paths in reconnect") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Karl Mehltretter Signed-off-by: Paulo Alcantara [ Adapted tcon_super_cb() changes to the older tcp_super_cb() callback and its server-only matching logic. ] Signed-off-by: Sasha Levin --- fs/smb/client/misc.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c index ddf105336f660..cf0ea3938e7d1 100644 --- a/fs/smb/client/misc.c +++ b/fs/smb/client/misc.c @@ -1316,8 +1316,14 @@ static void tcp_super_cb(struct super_block *sb, void *arg) cifs_sb = CIFS_SB(sb); tcon = cifs_sb_master_tcon(cifs_sb); - if (tcon->ses->server == server) + if (tcon->ses->server == server) { + /* + * Take the active reference while iterate_supers_type() still + * holds s_umount shared. + */ + cifs_sb_active(sb); sd->sb = sb; + } } static struct super_block *__cifs_get_super(void (*f)(struct super_block *, void *), @@ -1333,15 +1339,8 @@ static struct super_block *__cifs_get_super(void (*f)(struct super_block *, void for (; *fs_type; fs_type++) { iterate_supers_type(*fs_type, f, &sd); - if (sd.sb) { - /* - * Grab an active reference in order to prevent automounts (DFS links) - * of expiring and then freeing up our cifs superblock pointer while - * we're doing failover. - */ - cifs_sb_active(sd.sb); + if (sd.sb) return sd.sb; - } } return ERR_PTR(-EINVAL); } -- 2.53.0