[PATCH 6.1.y] ksmbd: fix NULL pointer dereference in opinfo_put()

[PATCH 6.1.y] ksmbd: fix NULL pointer dereference in opinfo_put()

[Jaskaran Singh]

Commit e1b21e606661 ("smb: server: fix use-after-free in smb2_open()")
is the 6.1.y backport of upstream commit 1e689a561738 ("smb: server: fix
use-after-free in smb2_open()"). It calls opinfo_put(opinfo)
unconditionally at the end of smb2_open(). Upstream
opinfo_put() returns early on a NULL opinfo since commit ee426bfb9d09
("ksmbd: add refcnt to ksmbd_conn struct"), which is not in 6.1.y, so
here it dereferences NULL whenever the open got no oplock info.

smb_grant_oplock() allocates none for a directory opened without a v2
lease, which is how clients open the share root, so the first
"smbclient -c ls" or cifs mount against ksmbd oopses:

  BUG: kernel NULL pointer dereference, address: 000000000000003c
  RIP: 0010:opinfo_put+0x5/0x30 [ksmbd]
  Call Trace:
   smb2_open+0xbf9/0x1f80 [ksmbd]
   handle_ksmbd_work+0x164/0x430 [ksmbd]
   process_one_work+0x1c7/0x380
   worker_thread+0x4d/0x380

Return early from opinfo_put() on a NULL opinfo, as upstream does.

The problem does not exist upstream; this fix is for 6.1.y only.

Fixes: e1b21e606661 ("smb: server: fix use-after-free in smb2_open()")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Jaskaran Singh <jsingh@cloudlinux.com>
---
 fs/smb/server/oplock.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c
index 932e31a20216..f4ed5bbbeb6e 100644
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -196,6 +196,9 @@ static void opinfo_conn_put(struct oplock_info *opinfo)
 
 void opinfo_put(struct oplock_info *opinfo)
 {
+	if (!opinfo)
+		return;
+
 	if (!atomic_dec_and_test(&opinfo->refcount))
 		return;
 
-- 
2.43.7