github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-30 01:53:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

smb: server: fix use-after-free in smb2_open()

Browse Source 
The opinfo pointer obtained via rcu_dereference(fp->f_opinfo) is
dereferenced after rcu_read_unlock(), creating a use-after-free
window.

Cc: stable@vger.kernel.org
Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
This commit is contained in:
Marios Makassikis 2026-03-03 11:14:32 +01:00 committed by Steve French
parent eac3361e3d
commit 1e689a5617
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
fs/smb/server/smb2pdu.c
View File

@ -3617,10 +3617,8 @@ int smb2_open(struct ksmbd_work *work)
reconnected_fp:
rsp->StructureSize = cpu_to_le16(89);
rcu_read_lock();
opinfo = rcu_dereference(fp->f_opinfo);
opinfo = opinfo_get(fp);
rsp->OplockLevel = opinfo != NULL ? opinfo->level : 0;
rcu_read_unlock();
rsp->Flags = 0;
rsp->CreateAction = cpu_to_le32(file_info);
rsp->CreationTime = cpu_to_le64(fp->create_time);
@ -3661,6 +3659,7 @@ int smb2_open(struct ksmbd_work *work)
next_ptr = &lease_ccontext->Next;
next_off = conn->vals->create_lease_size;
}
opinfo_put(opinfo);
if (maximal_access_ctxt) {
struct create_context *mxac_ccontext;