kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/fs/smb
History
Henrique Carvalho 065bd62412 smb: client: fix potential UAF in smb2_close_cached_fid() 
commit 734e99623c upstream.

find_or_create_cached_dir() could grab a new reference after kref_put()
had seen the refcount drop to zero but before cfid_list_lock is acquired
in smb2_close_cached_fid(), leading to use-after-free.

Switch to kref_put_lock() so cfid_release() is called with
cfid_list_lock held, closing that gap.

Fixes: ebe98f1447 ("cifs: enable caching of directories for which a lease is held")
Cc: stable@vger.kernel.org
Reported-by: Jay Shin <jaeshin@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-11-13 15:34:40 -05:00
..
client smb: client: fix potential UAF in smb2_close_cached_fid() 2025-11-13 15:34:40 -05:00
common smb: smbdirect: introduce smbdirect_socket_parameters 2025-07-06 11:01:42 +02:00
server ksmbd: use sock_create_kern interface to create kernel socket 2025-11-13 15:34:32 -05:00
Kconfig smb: move client and server files to common directory fs/smb 2023-05-24 16:29:21 -05:00
Makefile smb: move client and server files to common directory fs/smb 2023-05-24 16:29:21 -05:00