From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794061541; b=pNnDMO7MN/Pa7d+895Uj7dORmXC2Ido2E0NtQPhWS7pThI1ukPjep9RDppkabTEYCSne T+CPtz3hreNMz/9b6cdi1wfj5gVbZBEXRnEuTJcY0Pd2VCLnCsA8+y6nSmKySa4REf1xB p2USV5kmOCiolPpi+nxvP38Zuxj7p6UhHUOpq+iuFNayoqBpox0JW5YVJ+iA9QJnesFA6 D5nVLY2w4aEbqyvqqkSvBRb3qb6XWvHfUzAjoc7aXZ5FaBPyk9kMHmunVaeZJ0o7AaN2m e3XaPyOIuh9GDjpRZ5oBgKwO6kbAdlnmurji7VPzH3PE8e7geCnGEOOrPh7E2FPMEFA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794061541; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=pUyxgipHawSS964WC4pT8gzscbK2cgxoEQi+q8giV+Y=; b=HTioiyhLJF74Y3m7YV8FtrhsSq9/6cfK1etAnLoF59BiLlw8kh7QCPw3oD+V42uvKsq/ hq9bH/ymf5UdMAMr9W2Pu6KoToPUMUvXIoYzz8Ie6ZD00romgOvSb/5SGG0xpQkjdzfIV Yc9pCLreSK+aIjSqoOFRnMZs1QSQy4/FeQHVitD0/UegL8J5rXpM+otlpLc398C3Rb3Lv N6qPhxfQ9cL6Rzox1hdYcK4+z8KXdvkNjCY/3LqICn+OrZtb4n8X5fEn5/9E1KH/LC5UU 2Q+cC62n/xyrx3zk1yqtJSe4Hz9Rxdbw6TAFRHPHgZKIvHk9+wMPZF/I/Qe/oPvsf4g== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=D8e4IHF9; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AB826606A326; Sat, 7 Nov 2026 14:25:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=D8e4IHF9 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A6891F0089F; Sat, 7 Nov 2026 14:25:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794061540; bh=pUyxgipHawSS964WC4pT8gzscbK2cgxoEQi+q8giV+Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=D8e4IHF9agWSYG5eqhP1Uuma1SAu0YTuMFh21mnHJ469WJhMe741gJQRzc9DeHwMw UM+HKKk0cdMVI2keZ20QNkSbhi8Yoq5bL2AetoiuAVbG/itbmc7IOuxqB40OZ1aPHu 9VrHxbuUD/ATT8TVTobHpdyBFAK0jP+uC+FIV6m4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, AutonomousCodeSecurity@microsoft.com, "Cen Zhang (Microsoft)" , Namjae Jeon Subject: [PATCH 6.12 0587/1536] ksmbd: fix parent dentry lifetime in directory enumeration Date: Sat, 7 Nov 2026 08:43:23 -0500 Message-ID: <20261107135014.023075036@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134957.653319350@linuxfoundation.org> References: <20261107134957.653319350@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Cen Zhang (Microsoft) commit 171df27077fb49b4af2c53ad2cedcd0e39664fe8 upstream. ksmbd_populate_dot_dotdot_entries() builds the ".." entry from the open directory's d_parent and passes that pointer to ksmbd_vfs_fill_dentry_attrs() without taking a reference. That pointer is only valid while the directory stays under this parent. If a concurrent rename moves the directory elsewhere, the old parent loses its last reference; a following rmdir then turns it into a negative dentry with d_inode cleared, and after the RCU grace period the dentry itself is freed. The worker still holds the raw pointer and dereferences d_inode through vfs_getattr() and vfs_getxattr(). A remote SMB client, authenticated or guest, triggers this by listing a directory while that directory is moved under a new parent and the old parent is deleted. It can be done by the client itself with write access or by other concurrent writers, triggering null-ptr-deref and slab-use-after-free on a KASAN build. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: ksmbd-io handle_ksmbd_work RIP: 0010:xattr_permission+0x9d/0x160 Call Trace: vfs_getxattr+0x9c/0x1b0 ksmbd_vfs_getxattr+0x82/0x100 ksmbd_vfs_get_dos_attrib_xattr+0x7f/0x130 ksmbd_vfs_fill_dentry_attrs+0x435/0x650 ksmbd_populate_dot_dotdot_entries+0x25e/0x630 smb2_query_dir+0xcf9/0x1a20 handle_ksmbd_work+0x5f1/0x1c80 process_one_work+0x90b/0x19d0 Fix by using the dentry reference counting APIs: take the parent with dget_parent(), take a matching dget() on ".", and dput() the dentry once ksmbd_vfs_fill_dentry_attrs() has returned or the pattern does not match. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Cc: AutonomousCodeSecurity@microsoft.com Signed-off-by: Cen Zhang (Microsoft) Signed-off-by: Namjae Jeon Signed-off-by: Greg Kroah-Hartman --- fs/smb/server/smb_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/fs/smb/server/smb_common.c +++ b/fs/smb/server/smb_common.c @@ -447,16 +447,17 @@ int ksmbd_populate_dot_dotdot_entries(st if (i == 0) { d_info->name = "."; d_info->name_len = 1; - dentry = dir->filp->f_path.dentry; + dentry = dget(dir->filp->f_path.dentry); } else { d_info->name = ".."; d_info->name_len = 2; - dentry = dir->filp->f_path.dentry->d_parent; + dentry = dget_parent(dir->filp->f_path.dentry); } if (!match_pattern(d_info->name, d_info->name_len, search_pattern)) { dir->dot_dotdot[i] = 1; + dput(dentry); continue; } @@ -465,6 +466,7 @@ int ksmbd_populate_dot_dotdot_entries(st idmap, dentry, &ksmbd_kstat); + dput(dentry); if (rc) break;