From 8fc9af68c57156ff64769f30e831553cd03b3000 Mon Sep 17 00:00:00 2001 From: Ratnaker Gautam Date: Sun, 18 Oct 2026 00:49:33 +0200 Subject: [PATCH 01/12] smb: client: bound POSIX lock data area by response length CIFSSMBPosixLock() receives a TRANS2 response whose server-provided DataOffset and DataCount are not required by validate_t2() to describe an interval inside the response. A server can therefore make the client read a cifs_posix_lock beyond the response buffer and return those kernel bytes through F_GETLK. Use smbCalcSize() to obtain the full response length after any multipart TRANS2 reassembly, then reject data areas that extend past it before dereferencing them. Fixes: fc94cdb94462 ("[CIFS] Fix new POSIX Locking for setting lock_type correctly on unlock") Reported-by: Ratnaker Gautam Cc: stable@vger.kernel.org Signed-off-by: Ratnaker Gautam Reviewed-by: Namjae Jeon Signed-off-by: Paulo Alcantara --- fs/smb/client/cifssmb.c | 8 ++++++++ fs/smb/client/trace.h | 1 + 2 files changed, 9 insertions(+) diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c index 50ca062a22bf..e335686a68f2 100644 --- a/fs/smb/client/cifssmb.c +++ b/fs/smb/client/cifssmb.c @@ -2369,6 +2369,7 @@ CIFSSMBPosixLock(const unsigned int xid, struct cifs_tcon *tcon, cifs_dbg(FYI, "Send error in Posix Lock = %d\n", rc); } else if (pLockData) { /* lock structure can be returned on get */ + unsigned int rsp_len; __u16 data_offset; __u16 data_count; rc = validate_t2((struct smb_t2_rsp *)pSMBr); @@ -2380,11 +2381,18 @@ CIFSSMBPosixLock(const unsigned int xid, struct cifs_tcon *tcon, } data_offset = le16_to_cpu(pSMBr->t2.DataOffset); data_count = le16_to_cpu(pSMBr->t2.DataCount); + rsp_len = smbCalcSize(&pSMBr->hdr); if (data_count < sizeof(struct cifs_posix_lock)) { rc = smb_EIO2(smb_eio_trace_lock_data_too_small, data_count, sizeof(struct cifs_posix_lock)); goto plk_err_exit; } + if (data_offset > rsp_len || + data_count > rsp_len - data_offset) { + rc = smb_EIO2(smb_eio_trace_lock_data_area, + data_offset, data_count); + goto plk_err_exit; + } parm_data = (struct cifs_posix_lock *) ((char *)&pSMBr->hdr.Protocol + data_offset); if (parm_data->lock_type == cpu_to_le16(CIFS_UNLCK)) diff --git a/fs/smb/client/trace.h b/fs/smb/client/trace.h index 2708bedb49ab..5331ce6dc8b3 100644 --- a/fs/smb/client/trace.h +++ b/fs/smb/client/trace.h @@ -44,6 +44,7 @@ EM(smb_eio_trace_ioctl_no_rsp, "ioctl_no_rsp") \ EM(smb_eio_trace_ioctl_out_off, "ioctl_out_off") \ EM(smb_eio_trace_lock_bcc_too_small, "lock_bcc_too_small") \ + EM(smb_eio_trace_lock_data_area, "lock_data_area") \ EM(smb_eio_trace_lock_data_too_small, "lock_data_too_small") \ EM(smb_eio_trace_malformed_ksid_key, "malformed_ksid_key") \ EM(smb_eio_trace_malformed_sid_key, "malformed_sid_key") \ From 83d0d5e0ca22233c75daf139ec0063b9d2ff1ac7 Mon Sep 17 00:00:00 2001 From: Ratnaker Gautam Date: Sat, 17 Oct 2026 23:15:05 +0200 Subject: [PATCH 02/12] smb: client: validate NT transaction response layout and offsets validate_ntransact() assumes that the response uses the fixed 18-word NT transaction layout. A different WordCount makes get_bcc() locate the byte count at a different offset from pSMBr->ByteCount, allowing the subsequent bounds checks to use inconsistent response boundaries. The function also turns the 32-bit ParameterOffset and DataOffset fields into pointers before checking their bounds. On a 32-bit client, a large offset can wrap the pointer below end_of_smb and pass the one-sided pointer comparison. The caller then dereferences the parameter pointer or copies from the data pointer. Require the expected WordCount before reading the byte count. Check each offset and count against the received SMB length as integers before forming either pointer. Use subtraction after validating the offset so that the range checks cannot overflow. Reported-by: Ratnaker Gautam Fixes: 0a4b92c05ed0 ("[CIFS] Add worker function for Get ACL cifs style") Cc: stable@vger.kernel.org Signed-off-by: Ratnaker Gautam Reviewed-by: Namjae Jeon Signed-off-by: Paulo Alcantara --- fs/smb/client/cifssmb.c | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c index e335686a68f2..9ffc94ac2069 100644 --- a/fs/smb/client/cifssmb.c +++ b/fs/smb/client/cifssmb.c @@ -3787,9 +3787,10 @@ static int validate_ntransact(char *buf, char **ppparm, char **ppdata, __u32 *pparmlen, __u32 *pdatalen) { - char *end_of_smb; __u32 data_count, data_offset, parm_count, parm_offset; struct smb_com_ntransact_rsp *pSMBr; + size_t buflen; + char *end_buf; u16 bcc; *pdatalen = 0; @@ -3800,37 +3801,42 @@ validate_ntransact(char *buf, char **ppparm, char **ppdata, pSMBr = (struct smb_com_ntransact_rsp *)buf; + if (pSMBr->hdr.WordCount != 18) { + cifs_dbg(FYI, "invalid NT transaction WordCount %u\n", + pSMBr->hdr.WordCount); + return -EINVAL; + } + bcc = get_bcc(&pSMBr->hdr); - end_of_smb = 2 /* sizeof byte count */ + bcc + - (char *)&pSMBr->ByteCount; + end_buf = 2 /* sizeof byte count */ + bcc + (char *)&pSMBr->ByteCount; + buflen = end_buf - buf; data_offset = le32_to_cpu(pSMBr->DataOffset); data_count = le32_to_cpu(pSMBr->DataCount); parm_offset = le32_to_cpu(pSMBr->ParameterOffset); parm_count = le32_to_cpu(pSMBr->ParameterCount); - *ppparm = (char *)&pSMBr->hdr.Protocol + parm_offset; - *ppdata = (char *)&pSMBr->hdr.Protocol + data_offset; - /* should we also check that parm and data areas do not overlap? */ - if (*ppparm > end_of_smb) { + if (parm_offset > buflen) { cifs_dbg(FYI, "parms start after end of smb\n"); return -EINVAL; - } else if (parm_count + *ppparm > end_of_smb) { + } else if (parm_count > buflen - parm_offset) { cifs_dbg(FYI, "parm end after end of smb\n"); return -EINVAL; - } else if (*ppdata > end_of_smb) { + } else if (data_offset > buflen) { cifs_dbg(FYI, "data starts after end of smb\n"); return -EINVAL; - } else if (data_count + *ppdata > end_of_smb) { - cifs_dbg(FYI, "data %p + count %d (%p) past smb end %p start %p\n", - *ppdata, data_count, (data_count + *ppdata), - end_of_smb, pSMBr); + } else if (data_count > buflen - data_offset) { + cifs_dbg(FYI, "data offset %u + count %u past smb length %zu\n", + data_offset, data_count, buflen); return -EINVAL; } else if (parm_count + data_count > bcc) { cifs_dbg(FYI, "parm count and data count larger than SMB\n"); return -EINVAL; } + + *ppparm = buf + parm_offset; + *ppdata = buf + data_offset; *pdatalen = data_count; *pparmlen = parm_count; return 0; From 73cc469b0ff7551f8537ea919709973e6dc4f514 Mon Sep 17 00:00:00 2001 From: Luxiao Xu Date: Fri, 16 Oct 2026 15:11:01 +0800 Subject: [PATCH 03/12] smb: client: fix buffer overflow in SMB2_tcon() In SMB2_tcon(), unc_path is allocated with a fixed buffer size of MAX_SHARENAME_LENGTH * 2 bytes (672 bytes). However, the user-controlled UNC path (tree) length is passed to cifs_strtoUTF16(), which assumes the destination buffer is large enough and writes strlen(tree) + 1 UTF-16 code units. Commit 62a1a439e0fd ("cifs: clean up handling of unc= option") removed the length check on UNC mount options, allowing mount paths to exceed MAX_SHARENAME_LENGTH while retaining the fixed-size buffer allocation in SMB2_tcon(). Consequently, an oversized UNC string causes cifs_strtoUTF16() to write past the end of the heap object, resulting in a slab-out-of-bounds write. Furthermore, if a tree exceeds MAX_TREE_SIZE characters, strscpy() truncates it in cifs_tcon::tree_name, causing subsequent reconnects or failovers to fail. Fix this by first verifying that the length of tree does not exceed MAX_TREE_SIZE, returning -EINVAL if it does. Then, dynamically allocate unc_path based on the length of tree so that it safely accommodates all UTF-16 code units for paths within MAX_TREE_SIZE. Fixes: 62a1a439e0fd ("cifs: clean up handling of unc= option") Cc: stable@vger.kernel.org Reported-by: Xin Liu Closes: https://bugtracker.nebusec.ai/f/3292 Assisted-by: LLM Suggested-by: Paulo Alcantara Signed-off-by: Luxiao Xu Signed-off-by: Ren Wei [pc: remove unused MAX_SHARENAME_LENGTH] Signed-off-by: Paulo Alcantara --- fs/smb/client/smb2pdu.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index b140ec0a71a8..5d892300dabf 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -2104,8 +2104,6 @@ SMB2_logoff(const unsigned int xid, struct cifs_ses *ses) return rc; } -#define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */) - /* These are similar values to what Windows uses */ static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon) { @@ -2135,7 +2133,15 @@ int SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, if (!server || !tree) return smb_EIO(smb_eio_trace_null_pointers); - unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL); + total_len = strlen(tree); + if (total_len > MAX_TREE_SIZE) { + cifs_server_dbg(VFS | ONCE, + "%s: tree name exceeded %u characters\n", + __func__, MAX_TREE_SIZE); + return -EINVAL; + } + + unc_path = kmalloc((total_len + 1) * sizeof(*unc_path), GFP_KERNEL); if (unc_path == NULL) return -ENOMEM; From 4d8930afa3446041358a7db33e7b23a0bb9459b5 Mon Sep 17 00:00:00 2001 From: Abdifatah Suruur Date: Thu, 22 Oct 2026 06:53:14 +0300 Subject: [PATCH 04/12] smb: client: reject short SESSION_SETUP responses smb2_check_message() accepts frames shorter than struct smb2_pdu when the SMB2 status is non-zero, before the minimum-PDU check added by b4694f269e66d. A 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP response is therefore accepted even though it cannot contain the SecurityBufferOffset and SecurityBufferLength fields. The parser then reads those fields from stale bytes left in the reused receive buffer by an earlier frame. With a long stale SecurityBufferLength, decode_ntlmssp_challenge() copies up to about 64 KB from beyond the receive object and sends the data back to the server in the NTLMv2 AUTHENTICATE target info. Reject short MPR SESSION_SETUP responses before the short-error path, and validate SecurityBufferOffset + SecurityBufferLength against the received response length before decoding the challenge. The ordering bypass is not new: the short-error early return predates b4694f269e66d, and the unvalidated SecurityBufferLength read predates the 2016 raw NTLMSSP split in 166cea4dc3a4, so all supported stable trees are affected. Reproduced on 6.6.87.2; the path is unchanged on mainline. Fixes: 5478f9ba9a34 ("CIFS: Add session setup/logoff capability for SMB2") Cc: stable@vger.kernel.org Signed-off-by: Abdifatah Suruur Reviewed-by: Namjae Jeon Signed-off-by: Paulo Alcantara --- fs/smb/client/smb2misc.c | 16 ++++++++++++++++ fs/smb/client/smb2pdu.c | 10 ++++++++-- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c index 5e5cf92d1eb3..5f13bd7ce73c 100644 --- a/fs/smb/client/smb2misc.c +++ b/fs/smb/client/smb2misc.c @@ -225,6 +225,22 @@ smb2_check_message(char *buf, unsigned int pdu_len, unsigned int len, return 1; } + /* + * A SESSION_SETUP response that asks for more processing carries a + * security blob and is parsed as a normal reply. Do not let the + * short-error path below accept a frame that cannot hold the fixed + * response fields; the minimum-PDU check later is unreachable once + * the early return has accepted the frame. + */ + if (command == SMB2_SESSION_SETUP_HE && + shdr->Status == STATUS_MORE_PROCESSING_REQUIRED && + len < smb2_min_pdu_len[command]) { + cifs_server_dbg(VFS, + "%s: session setup response too short: %u < %zu\n", + __func__, len, smb2_min_pdu_len[command]); + return 1; + } + if (len < pdu_size) { if ((len >= hdr_size) && (shdr->Status != 0)) { diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 5d892300dabf..06a6ca0dc098 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -1857,14 +1857,20 @@ SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data) goto out; u16 boff = le16_to_cpu(rsp->SecurityBufferOffset); + u16 blen = le16_to_cpu(rsp->SecurityBufferLength); if (offsetof(struct smb2_sess_setup_rsp, Buffer) != boff) { cifs_dbg(VFS, "Invalid security buffer offset %d\n", boff); rc = smb_EIO1(smb_eio_trace_sess_buf_off, boff); goto out; } - rc = decode_ntlmssp_challenge(rsp->Buffer, - le16_to_cpu(rsp->SecurityBufferLength), ses); + if ((u32)boff + blen > sess_data->iov[0].iov_len) { + cifs_dbg(VFS, "%s: invalid security buffer length: %u\n", + __func__, blen); + rc = -EINVAL; + goto out; + } + rc = decode_ntlmssp_challenge(rsp->Buffer, blen, ses); if (rc) goto out; From 2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1 Mon Sep 17 00:00:00 2001 From: Abdifatah Suruur Date: Thu, 22 Oct 2026 06:53:29 +0300 Subject: [PATCH 05/12] smb: client: validate the data area in SMB2_read() SMB2_read() copies le32_to_cpu(rsp->DataLength) bytes from (char *)rsp + rsp->DataOffset without checking that the range lies within the response actually received. A READ response with DataOffset == 0 makes smb2_get_data_area_len() zero the data length, so smb2_check_message() accepts a frame as short as the fixed response, while SMB2_read() still uses the server-supplied DataLength, capped only by CIFS_MAX_MSGSIZE and the caller's length. A malicious server can answer the synchronous read used by the mfsymlinks (or SFU) symlink parser with an 81-byte READ response carrying DataOffset 0 and DataLength 1067, making the client copy 1067 bytes from a 448-byte receive object (KASAN slab-out-of-bounds; up to 16 KiB in the general case). Clamp a zero (or header-overlapping) DataOffset to read_rsp_size, as handle_read_data() does for the asynchronous path, and reject the response unless DataOffset + DataLength fits within rsp_iov.iov_len. The SMB1 helper was fixed the same way in 5be5bdda5863. Fixes: d8e050398d23 ("CIFS: Add readpage support for SMB2") Cc: stable@vger.kernel.org Signed-off-by: Abdifatah Suruur Reviewed-by: Namjae Jeon Signed-off-by: Paulo Alcantara --- fs/smb/client/smb2pdu.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 06a6ca0dc098..f85595136ef8 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -4948,6 +4948,7 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, struct kvec iov[1]; struct kvec rsp_iov; unsigned int total_len; + u16 data_offset; int flags = CIFS_LOG_ERROR; struct cifs_ses *ses = io_parms->tcon->ses; @@ -5007,8 +5008,29 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, *nbytes = 0; } + data_offset = rsp->DataOffset; + if (data_offset < io_parms->server->vals->read_rsp_size) { + /* + * win2k8 sometimes sends an offset of 0 when the read is beyond + * the EOF. Treat it as if the data starts just after the header, + * as handle_read_data() does. + */ + cifs_dbg(FYI, "data offset %u inside read response header\n", + data_offset); + data_offset = io_parms->server->vals->read_rsp_size; + } + + /* The data area must lie within the response actually received */ + if (*nbytes && (size_t)data_offset + *nbytes > rsp_iov.iov_len) { + cifs_dbg(FYI, "bad data offset %u length %u for response of %zu\n", + data_offset, *nbytes, rsp_iov.iov_len); + rc = smb_EIO2(smb_eio_trace_read_bad_offset, + data_offset, *nbytes); + *nbytes = 0; + } + if (*buf) { - memcpy(*buf, (char *)rsp + rsp->DataOffset, *nbytes); + memcpy(*buf, (char *)rsp + data_offset, *nbytes); free_rsp_buf(resp_buftype, rsp_iov.iov_base); } else if (resp_buftype != CIFS_NO_BUFFER) { *buf = rsp_iov.iov_base; From f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc Mon Sep 17 00:00:00 2001 From: Abdifatah Suruur Date: Fri, 23 Oct 2026 14:52:46 +0300 Subject: [PATCH 06/12] smb: client: fix fiemap wild read on empty truncated response smb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob and loops for the next chunk. If the server reports STATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns -E2BIG with out_data == NULL and out_data_len == 0, and the existing length checks accept the empty result. The loop then evaluates next = out_data[num - 1].file_offset + ... with num == 0, reading 16 bytes before NULL. Reject a truncated range blob that contains no range, so the resume offset is never computed from an empty response. Also require the last range in a truncated blob to advance the resume offset without overflowing, and to stay within the requested range; a malicious or broken server could otherwise make no progress or underflow len and loop forever. Free the previous response buffer before retrying. Reproduced on 6.6.87.2 with a malicious SMB2 server that answers FSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and OutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in cifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged on mainline. Fixes: 2f3ebaba13ce ("cifs: add fiemap support") Cc: stable@vger.kernel.org Signed-off-by: Abdifatah Suruur Signed-off-by: Paulo Alcantara --- fs/smb/client/smb2ops.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 20624f5dff9b..dc55cd512616 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4360,6 +4360,15 @@ static int smb3_fiemap(struct cifs_tcon *tcon, goto out; } + /* + * A truncated range blob must contain at least one range, otherwise + * there is no offset to resume from and out_data is NULL. + */ + if (!last_blob && out_data_len == 0) { + rc = -EINVAL; + goto out; + } + num = out_data_len / sizeof(struct file_allocated_range_buffer); for (i = 0; i < num; i++) { flags = 0; @@ -4380,10 +4389,25 @@ static int smb3_fiemap(struct cifs_tcon *tcon, } if (!last_blob) { - next = le64_to_cpu(out_data[num - 1].file_offset) + - le64_to_cpu(out_data[num - 1].length); - len = len - (next - start); + u64 last_start, last_len; + + last_start = le64_to_cpu(out_data[num - 1].file_offset); + last_len = le64_to_cpu(out_data[num - 1].length); + + if (check_add_overflow(last_start, last_len, &next) || + next <= start) { + rc = -EINVAL; + goto out; + } + if (next - start >= len) { + rc = 0; + goto out; + } + + len -= next - start; start = next; + kfree(out_data); + out_data = NULL; goto again; } From 482c117c6dbeee382790168af10959810450ab09 Mon Sep 17 00:00:00 2001 From: Eduard Zateev Date: Tue, 20 Oct 2026 21:45:45 +0200 Subject: [PATCH 07/12] smb: client: hold server info until cifsd exits The last session reference can be dropped while the cifsd demultiplex thread is still running clean_demultiplex_info(). That thread frees TCP_Server_Info there, racing with cifs_put_tcp_session() as it releases the server crypto state. syzbot reported a KASAN use-after-free in cifs_crypto_secmech_release(). Keep an object reference for the cifsd thread. Defer final crypto, session-key, network namespace, string, and structure cleanup until both the last session reference and the thread reference are dropped. Drop the thread reference after clean_demultiplex_info() has finished using the server. Build-tested with ARCH=arm64 and W=1 for fs/smb/client/connect.o. The KASAN reproducer was not run on the patched kernel. Fixes: a5c3e1c725af ("Revert "cifs: No need to send SIGKILL to demux_thread during umount"") Reported-by: syzbot+5c3ed2a0de3270efc921@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5c3ed2a0de3270efc921 Reported-by: syzbot+c2ec61adfbcb24e5ec20@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=c2ec61adfbcb24e5ec20 Assisted-by: LLM OpenAI Codex Signed-off-by: Eduard Zateev Cc: stable@vger.kernel.org Tested-by: Michail Andreas Michalopoulos Signed-off-by: Paulo Alcantara --- fs/smb/client/cifsglob.h | 2 ++ fs/smb/client/connect.c | 33 +++++++++++++++++++++------------ 2 files changed, 23 insertions(+), 12 deletions(-) diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h index 73b49dcb5215..d3ca688b6aba 100644 --- a/fs/smb/client/cifsglob.h +++ b/fs/smb/client/cifsglob.h @@ -16,6 +16,7 @@ #include #include #include +#include #include #include #include @@ -681,6 +682,7 @@ struct TCP_Server_Info { spinlock_t srv_lock; /* protect anything here that is not protected */ __u64 conn_id; /* connection identifier (useful for debugging) */ int srv_count; /* reference counter */ + refcount_t obj_refs; /* struct lifetime: srv_count users + cifsd */ int rfc1001_sessinit; /* whether to estasblish netbios session */ bool with_rfc1001; /* if netbios session is used */ /* 15 character server name + 0x20 16th byte indicating type = srv */ diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c index c3614c077746..e68fffb2ab2e 100644 --- a/fs/smb/client/connect.c +++ b/fs/smb/client/connect.c @@ -1083,6 +1083,19 @@ cifs_enable_signing(struct TCP_Server_Info *server, bool mnt_sign_required) return 0; } +static void cifs_tcp_server_put(struct TCP_Server_Info *server) +{ + if (!refcount_dec_and_test(&server->obj_refs)) + return; + + cifs_crypto_secmech_release(server); + kfree_sensitive(server->session_key.response); + put_net(cifs_net_ns(server)); + kfree(server->leaf_fullpath); + kfree(server->hostname); + kfree_sensitive(server); +} + static noinline_for_stack void clean_demultiplex_info(struct TCP_Server_Info *server) { @@ -1168,14 +1181,11 @@ clean_demultiplex_info(struct TCP_Server_Info *server) */ } - put_net(cifs_net_ns(server)); - kfree(server->leaf_fullpath); - kfree(server->hostname); - kfree_sensitive(server); - length = atomic_dec_return(&tcpSesAllocCount); if (length > 0) mempool_resize(cifs_req_poolp, length + cifs_min_rcv); + + cifs_tcp_server_put(server); } static int @@ -1751,7 +1761,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect) else cancel_delayed_work_sync(&server->reconnect); - /* For secondary channels, we pick up ref-count on the primary server */ + /* For secondary channels, drop the reference on the primary server */ if (SERVER_IS_CHAN(server)) cifs_put_tcp_session(server->primary_server, from_reconnect); @@ -1759,15 +1769,11 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect) server->tcpStatus = CifsExiting; spin_unlock(&server->srv_lock); - cifs_crypto_secmech_release(server); - - kfree_sensitive(server->session_key.response); - server->session_key.response = NULL; - server->session_key.len = 0; - task = xchg(&server->tsk, NULL); if (task) send_sig(SIGKILL, task, 1); + + cifs_tcp_server_put(server); } struct TCP_Server_Info * @@ -1789,6 +1795,7 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx, rc = -ENOMEM; goto out_err; } + refcount_set(&tcp_ses->obj_refs, 1); tcp_ses->hostname = kstrdup(ctx->server_hostname, GFP_KERNEL); if (!tcp_ses->hostname) { @@ -1927,6 +1934,8 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx, module_put(THIS_MODULE); goto out_err_crypto_release; } + /* Keep the server alive until the demultiplex thread has exited */ + refcount_inc(&tcp_ses->obj_refs); /* thread created, put it on the list */ spin_lock(&cifs_tcp_ses_lock); list_add(&tcp_ses->tcp_ses_list, &cifs_tcp_ses_list); From a377a3645c7d0246af0bc4ef24db94bb2670bdde Mon Sep 17 00:00:00 2001 From: Dominik Maier Date: Fri, 23 Oct 2026 01:21:16 +0200 Subject: [PATCH 08/12] smb: client: fix slab-out-of-bounds write in id_mode_to_cifs_acl() In id_mode_to_cifs_acl(), while the chown branch reserves sizeof(struct smb_ntsd) + 2 * sizeof(struct smb_sid) (plus sizeof(struct smb_acl) and the worst-case ACE space after commit 0ee150794c75 ("smb: client: fix heap overflow in DACL owner/group rewrite")), the chmod branch only adds 2 * sizeof(struct smb_ace) or 5 * sizeof(struct smb_ace) to secdesclen (or 1 * sizeof(struct smb_ace) on posix). However, the chmod branch also invokes build_sec_desc() -> copy_sec_desc(), which unconditionally writes the Owner SID at pnntsd + sidsoffset and the Group SID at pnntsd + sidsoffset + sizeof(struct smb_sid) (2 * 68 = 136 bytes total), and set_chmod_dacl() always writes a struct smb_acl header (8 bytes) even when the source descriptor has dacloffset == 0. When a security descriptor has compact or overlapping Owner/Group SIDs (or dacloffset == 0), calling chmod() under-allocates pnntsd and writes past the end of the slab buffer. Reserve sizeof(struct smb_acl) + 2 * sizeof(struct smb_sid) (plus sizeof(struct smb_ntsd) on the posix path) in the chmod branch of id_mode_to_cifs_acl(). Fixes: 7ee0b4c635c0 ("cifs: fix hardcoded default security descriptor length") Fixes: f5065508897a ("cifs: Retain old ACEs when converting between mode bits and ACL.") Assisted-by: ARTIST LLM Signed-off-by: Dominik Maier Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara --- fs/smb/client/cifsacl.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c index d1a92bb4d9a5..f9f61c758a75 100644 --- a/fs/smb/client/cifsacl.c +++ b/fs/smb/client/cifsacl.c @@ -1826,12 +1826,15 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, /* Potentially, five new ACEs can be added to the ACL for U,G,O mapping */ if (pnmode && *pnmode != NO_CHANGE_64) { /* chmod */ + nsecdesclen = sizeof(struct smb_acl) + + 2 * sizeof(struct smb_sid); if (posix) - nsecdesclen = 1 * sizeof(struct smb_ace); + nsecdesclen += sizeof(struct smb_ntsd) + + sizeof(struct smb_ace); else if (mode_from_sid) - nsecdesclen = secdesclen + (2 * sizeof(struct smb_ace)); + nsecdesclen += secdesclen + 2 * sizeof(struct smb_ace); else /* cifsacl */ - nsecdesclen = secdesclen + (5 * sizeof(struct smb_ace)); + nsecdesclen += secdesclen + 5 * sizeof(struct smb_ace); } else { /* chown */ /* When ownership changes, changes new owner sid length could be different */ nsecdesclen = sizeof(struct smb_ntsd) + (sizeof(struct smb_sid) * 2); From 7b1afb631395c958993cda4631002258ef4151ea Mon Sep 17 00:00:00 2001 From: Fredric Cover Date: Thu, 22 Oct 2026 21:55:06 +0000 Subject: [PATCH 09/12] smb: client: fix early procfs exposure race Currently, init_cifs() calls cifs_proc_init() near the beginning of the function, before INIT_LIST_HEAD, leading to a momentarily uninitialized, but exposed, procfs. If a userspace process reads this empty procfs, iterating over a zeroed list_head leads to a NULL pointer dereference and a kernel oops/panic. For example, if a delay is added between cifs_proc_init() and INIT_LIST_HEAD, and a userspace process is polling /proc/fs/cifs/DebugData, the following oops occurs: BUG: kernel NULL pointer dereference, address: 0000000000000608 Oops: Oops: 0000 [#1] SMP PTI CPU: 0 UID: 0 PID: 3477 Comm: cat Not tainted 7.3.0-02212-g4df4d2a577db-dirty #6 PREEMPT(lazy) RIP: 0010:cifs_debug_data_proc_show+0x103/0xd80 [cifs] Call Trace: ? seq_read_iter+0x86/0x400 ? seq_read_iter+0x86/0x400 seq_read_iter+0x183/0x400 proc_reg_read_iter+0x62/0x90 copy_splice_read+0x215/0x310 splice_file_to_pipe+0xec/0x1c0 do_splice+0x4b8/0x780 __se_sys_splice+0x18f/0x250 do_syscall_64+0x109/0x330 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this by moving cifs_proc_init() down in init_cifs(), ensuring it runs only after all internal lists, locks, counters, and workqueues are fully ready, but before registering the filesystem. Update the error cleanup ladder and exit_cifs() to maintain proper LIFO order. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Fredric Cover Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara --- fs/smb/client/cifsfs.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c index 576155caf888..bf199a5ca084 100644 --- a/fs/smb/client/cifsfs.c +++ b/fs/smb/client/cifsfs.c @@ -2019,7 +2019,6 @@ init_cifs(void) if (rc) return rc; - cifs_proc_init(); INIT_LIST_HEAD(&cifs_tcp_ses_list); /* * Initialize Global counters @@ -2068,10 +2067,8 @@ init_cifs(void) cifsiod_wq = alloc_workqueue("cifsiod", WQ_FREEZABLE | WQ_MEM_RECLAIM | WQ_PERCPU, 0); - if (!cifsiod_wq) { - rc = -ENOMEM; - goto out_clean_proc; - } + if (!cifsiod_wq) + return -ENOMEM; /* * Consider in future setting limit!=0 maybe to min(num_of_cores - 1, 3) @@ -2162,19 +2159,22 @@ init_cifs(void) if (rc) goto out_cifs_swn_init; + cifs_proc_init(); + rc = register_filesystem(&cifs_fs_type); if (rc) - goto out_init_cifs_idmap; + goto out_clean_proc; rc = register_filesystem(&smb3_fs_type); if (rc) { unregister_filesystem(&cifs_fs_type); - goto out_init_cifs_idmap; + goto out_clean_proc; } return 0; -out_init_cifs_idmap: +out_clean_proc: + cifs_proc_clean(); exit_cifs_idmap(); out_cifs_swn_init: #ifdef CONFIG_CIFS_SWN_UPCALL @@ -2210,8 +2210,6 @@ init_cifs(void) destroy_workqueue(decrypt_wq); out_destroy_cifsiod_wq: destroy_workqueue(cifsiod_wq); -out_clean_proc: - cifs_proc_clean(); return rc; } @@ -2221,6 +2219,7 @@ exit_cifs(void) cifs_dbg(NOISY, "exit_smb3\n"); unregister_filesystem(&cifs_fs_type); unregister_filesystem(&smb3_fs_type); + cifs_proc_clean(); cifs_release_automount_timer(); exit_cifs_idmap(); #ifdef CONFIG_CIFS_SWN_UPCALL @@ -2243,7 +2242,6 @@ exit_cifs(void) destroy_workqueue(serverclose_wq); destroy_workqueue(cfid_put_wq); destroy_workqueue(cifsiod_wq); - cifs_proc_clean(); } MODULE_AUTHOR("Steve French"); From d58e7b40908a8a57755811d5b37af1df3380278f Mon Sep 17 00:00:00 2001 From: Paulo Alcantara Date: Sun, 25 Oct 2026 20:48:08 -0300 Subject: [PATCH 10/12] smb: client: don't resurrect an exiting tcon from cached dir workers cfids_laundromat_worker() bumps tcon->tc_count for every expired open cfid and queues cached_dir_offload_close() without checking whether the tcon is already being torn down. Racing with the final cifs_put_tcon(), the tcon comes back from zero and gets torn down twice: T1 T2 cifs_put_tcon() --tc_count == 0, TID_EXITING tconInfoFree() free_cached_dirs() cancel_delayed_work_sync() cfids_laundromat_worker() ++tc_count == 1 queue_work(serverclose_wq) kfree(tcon->origin_fullpath) kfree(tcon) cached_dir_offload_close() close_cached_dir() [UAF] cifs_put_tcon() tconInfoFree() [double free] cached_dir_lease_break() also bumps tc_count without tc_lock, racing with the laundromat's locked update. Take the tcon reference through a helper that refuses once the tcon is TID_EXITING or its refcount has dropped to zero. Queued put_work and close_work then always hold a tcon reference, so tconInfoFree() can't run before they finish and free_cached_dirs() doesn't need to flush any workqueue. If the laundromat can't get a reference, put the cfid back on the dying list for free_cached_dirs() to free; its handle goes away with the tree connection. The lease break path finds the tcon on ses->tcon_list under cifs_tcp_ses_lock, so it can't see TID_EXITING, but it now takes tc_lock. Fixes: 3fa640d035e5 ("smb: During unmount, ensure all cached dir instances drop their dentry") Reviewed-by: Namjae Jeon Signed-off-by: Paulo Alcantara Cc: David Howells Cc: Namjae Jeon Cc: Ronnie Sahlberg Cc: Shyam Prasad N Cc: Tom Talpey Cc: Bharath SM Cc: stable@vger.kernel.org --- fs/smb/client/cached_dir.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c index 647fa26da4d2..50217f47a0ed 100644 --- a/fs/smb/client/cached_dir.c +++ b/fs/smb/client/cached_dir.c @@ -649,6 +649,17 @@ void invalidate_all_cached_dirs(struct cifs_tcon *tcon, bool sync) flush_delayed_work(&cfids->laundromat_work); } +static bool cached_dir_get_tcon(struct cifs_tcon *tcon, + enum smb3_tcon_ref_trace trace) +{ + guard(spinlock)(&tcon->tc_lock); + if (tcon->status == TID_EXITING || tcon->tc_count <= 0) + return false; + ++tcon->tc_count; + trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, trace); + return true; +} + static void cached_dir_offload_close(struct work_struct *work) { @@ -693,6 +704,9 @@ bool cached_dir_lease_break(struct cifs_tcon *tcon, __u8 lease_key[16]) !memcmp(lease_key, cfid->fid.lease_key, SMB2_LEASE_KEY_SIZE)) { + if (!cached_dir_get_tcon(tcon, + netfs_trace_tcon_ref_get_cached_lease_break)) + break; cfid->has_lease = false; cfid->time = 0; /* @@ -703,9 +717,6 @@ bool cached_dir_lease_break(struct cifs_tcon *tcon, __u8 lease_key[16]) cfid->on_list = false; cfids->num_entries--; - ++tcon->tc_count; - trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, - netfs_trace_tcon_ref_get_cached_lease_break); queue_work(cfid_put_wq, &cfid->put_work); spin_unlock(&cfids->cfid_list_lock); return true; @@ -813,12 +824,13 @@ static void cfids_laundromat_worker(struct work_struct *work) cfid->dentry = NULL; if (cfid->is_open) { - spin_lock(&cfid->tcon->tc_lock); - ++cfid->tcon->tc_count; - trace_smb3_tcon_ref(cfid->tcon->debug_id, cfid->tcon->tc_count, - netfs_trace_tcon_ref_get_cached_laundromat); - spin_unlock(&cfid->tcon->tc_lock); - queue_work(serverclose_wq, &cfid->close_work); + if (cached_dir_get_tcon(cfid->tcon, + netfs_trace_tcon_ref_get_cached_laundromat)) { + queue_work(serverclose_wq, &cfid->close_work); + continue; + } + scoped_guard(spinlock, &cfids->cfid_list_lock) + list_add_tail(&cfid->entry, &cfids->dying); } else /* * Drop the ref-count from above, either the lease-ref (if there From 51efca72345acdbedc4af76782d464bd15ba50ff Mon Sep 17 00:00:00 2001 From: Weiming Shi Date: Sun, 25 Oct 2026 02:07:30 -0700 Subject: [PATCH 11/12] smb: client: stop processing a read response after a receive error cifs_read_iter_from_socket() may call cifs_reconnect() before returning an error. The reconnect path aborts pending mids and invokes their callbacks. The callback can then release the cifs_io_subrequest containing rdata. cifs_readv_receive() nevertheless continues after a negative return and may dereference rdata in cifs_readv_discard(). KASAN reports the resulting UAF: BUG: KASAN: slab-use-after-free in cifs_readv_receive Read of size 4 by task cifsd cifs_readv_receive (fs/smb/client/transport.c:1284) cifs_demultiplex_thread (fs/smb/client/connect.c:1355) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) Freed by task 148: netfs_put_subrequest (fs/netfs/objects.c:267) netfs_read_collection (fs/netfs/read_collect.c:460) netfs_wait_for_in_progress (fs/netfs/misc.c:462) Return the socket error immediately, as this path did before the iterator conversion. This also avoids adding a negative length to total_read. Cc: stable@vger.kernel.org Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Reported-by: co+24c7c12d69e63c6d@bugs.sh Assisted-by: LLM Signed-off-by: Weiming Shi Signed-off-by: Paulo Alcantara --- fs/smb/client/transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c index 60699d2799fb..d0d0159c1061 100644 --- a/fs/smb/client/transport.c +++ b/fs/smb/client/transport.c @@ -1345,6 +1345,8 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid) #endif length = cifs_read_iter_from_socket(server, &rdata->subreq.io_iter, data_len); + if (length < 0) + return length; if (length > 0) rdata->got_bytes += length; server->total_read += length; From ddc7a7e1eeb116ccaf010a6f1fb6ab927f3f888d Mon Sep 17 00:00:00 2001 From: Ratnaker Gautam Date: Sat, 24 Oct 2026 12:36:14 +0000 Subject: [PATCH 12/12] smb: client: validate SMB1 EA list bounds before parsing CIFSSMBQAllEAs() checks the server-provided EA list length by adding it to the response pointer. On 32-bit systems, a positive length can wrap the pointer and pass the comparison. The parser then walks outside the received response while reading the next FEA header. A response with a list length of 0x40000000 reproduces this as a native i386 page fault and kernel panic from listxattr() against an SMB1 server. Check that the EA list starts within the SMB byte area before reading its header. Keep its length unsigned and compare it with the bytes left in the response without pointer addition. SMB1 is not negotiated by default and requires an explicit vers=1.0 mount. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Ratnaker Gautam Signed-off-by: Paulo Alcantara --- fs/smb/client/cifssmb.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c index 9ffc94ac2069..2936b38de98f 100644 --- a/fs/smb/client/cifssmb.c +++ b/fs/smb/client/cifssmb.c @@ -6215,9 +6215,11 @@ CIFSSMBQAllEAs(const unsigned int xid, struct cifs_tcon *tcon, int rc = 0; int bytes_returned; int list_len; + u32 ea_list_len; struct fealist *ea_response_data; struct fea *temp_fea; char *temp_ptr; + char *byte_area; char *end_of_smb; __u16 params, byte_count, data_offset; unsigned int ea_name_len = ea_name ? strlen(ea_name) : 0; @@ -6296,9 +6298,19 @@ CIFSSMBQAllEAs(const unsigned int xid, struct cifs_tcon *tcon, ea_response_data = (struct fealist *) (((char *) &pSMBr->hdr.Protocol) + data_offset); - list_len = le32_to_cpu(ea_response_data->list_len); - cifs_dbg(FYI, "ea length %d\n", list_len); - if (list_len <= 8) { + byte_area = pByteArea(&pSMBr->hdr); + end_of_smb = byte_area + get_bcc(&pSMBr->hdr); + if ((char *)ea_response_data < byte_area || + (char *)ea_response_data > + end_of_smb - sizeof(ea_response_data->list_len)) { + rc = smb_EIO2(smb_eio_trace_qalleas_overlong, + data_offset, get_bcc(&pSMBr->hdr)); + goto QAllEAsOut; + } + + ea_list_len = le32_to_cpu(ea_response_data->list_len); + cifs_dbg(FYI, "%s: ea length: %u\n", __func__, ea_list_len); + if (ea_list_len <= 8) { cifs_dbg(FYI, "empty EA list returned from server\n"); /* didn't find the named attribute */ if (ea_name) @@ -6307,14 +6319,14 @@ CIFSSMBQAllEAs(const unsigned int xid, struct cifs_tcon *tcon, } /* make sure list_len doesn't go past end of SMB */ - end_of_smb = (char *)pByteArea(&pSMBr->hdr) + get_bcc(&pSMBr->hdr); - if ((char *)ea_response_data + list_len > end_of_smb) { + if (ea_list_len > end_of_smb - (char *)ea_response_data) { cifs_dbg(FYI, "EA list appears to go beyond SMB\n"); rc = smb_EIO2(smb_eio_trace_qalleas_overlong, - (unsigned long)ea_response_data + list_len - (unsigned long)pSMBr, - (unsigned long)end_of_smb - (unsigned long)pSMBr); + ea_list_len, + end_of_smb - (char *)ea_response_data); goto QAllEAsOut; } + list_len = ea_list_len; /* account for ea list len */ list_len -= 4;