diff options
| author | ChenXiaoSong <chenxiaosong@kylinos.cn> | 2026-08-13 10:40:42 +0000 |
|---|---|---|
| committer | Namjae Jeon <linkinjeon@kernel.org> | 2026-08-17 22:38:22 +0900 |
| commit | 93a3cda16124fe0a7d80666e6dcb56c75cbedd1c (patch) | |
| tree | 2178c33da16c85ae9deb7fa9a8b7d3c8b44e178d /scripts/stackusage | |
| parent | 215e8816b1ac25176d911abb8704390413ccee4b (diff) | |
| download | linux-93a3cda16124fe0a7d80666e6dcb56c75cbedd1c.tar.gz linux-93a3cda16124fe0a7d80666e6dcb56c75cbedd1c.zip | |
smb/server: fix use-after-free in ksmbd_conn_transport_destroy()
Reproducer (Link[1]):
1. Build kernel with CONFIG_KASAN=y
2. server: systemctl start ksmbd
3. client: mount -t cifs //localhost/export /mnt
4. client: umount /mnt
5. server: modprobe -r ksmbd
The error message is as follows:
==================================================================
BUG: KASAN: slab-use-after-free in proc_remove+0x3e/0x80
Read of size 8 at addr ffff88810654e098 by task modprobe/785
...
Call Trace:
<TASK>
__dump_stack+0x19/0x30
dump_stack_lvl+0x49/0x60
print_address_description+0x7b/0x200
print_report+0x5b/0x70
kasan_report+0xed/0x130
__asan_report_load8_noabort+0x18/0x20
proc_remove+0x3e/0x80
ksmbd_conn_transport_destroy+0x2b/0x320 [ksmbd]
cleanup_module+0x33/0xe00 [ksmbd]
__se_sys_delete_module+0x276/0x400
__x64_sys_delete_module+0x5f/0x70
x64_sys_call+0x2675/0x3030
do_syscall_64+0xf0/0x3b0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f5b56d2b02b
...
</TASK>
Allocated by task 159:
kasan_save_track+0x2f/0x70
kasan_save_alloc_info+0x40/0x50
__kasan_slab_alloc+0x52/0x70
kmem_cache_alloc_noprof+0x168/0x3e0
__proc_create+0x20b/0x710
proc_create_single_data+0x78/0x150
ksmbd_proc_create+0x24/0x30 [ksmbd]
ksmbd_conn_transport_init+0x4f/0x80 [ksmbd]
server_ctrl_handle_work+0x64/0x2c0 [ksmbd]
process_scheduled_works+0x788/0xec0
worker_thread+0x894/0xc10
kthread+0x2e5/0x3c0
ret_from_fork+0x168/0x4f0
ret_from_fork_asm+0x1a/0x30
Freed by task 785:
kasan_save_track+0x2f/0x70
kasan_save_free_info+0x4a/0x60
__kasan_slab_free+0x47/0x70
kmem_cache_free+0x122/0x410
pde_put+0xfd/0x160
remove_proc_subtree+0x365/0x540
proc_remove+0x6a/0x80
ksmbd_proc_cleanup+0x1f/0x60 [ksmbd]
cleanup_module+0x18/0xe00 [ksmbd]
__se_sys_delete_module+0x276/0x400
__x64_sys_delete_module+0x5f/0x70
x64_sys_call+0x2675/0x3030
do_syscall_64+0xf0/0x3b0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
==================================================================
Reported-by: Kyenghwan Hwang <obnred@gmail.com>
Link[1]: https://lore.kernel.org/linux-cifs/8ea028f5-90f4-4d21-b1ac-a343f0f04d88@chenxiaosong.com/
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Diffstat (limited to 'scripts/stackusage')
0 files changed, 0 insertions, 0 deletions