ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation

When a blocking byte-range lock request is deferred in the
FILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into
the connection's async_requests list via setup_async_work(). The cancel
callback smb2_remove_blocked_lock() holds a reference to the flock.

If the lock waiter is subsequently woken up but the work state is no
longer KSMBD_WORK_ACTIVE (e.g., due to a concurrent cancellation), the
cleanup path calls locks_free_lock(flock) without dequeuing the work from
the async_requests list. Concurrently, smb2_cancel() walks the list
under conn->request_lock and invokes the cancel callback, which then
dereferences the already freed 'flock'. This leads to a slab-use-after-free
inside __wake_up_common.

Fix this by restructuring the cleanup logic after the worker returns
from ksmbd_vfs_posix_lock_wait(). Move list_del(&smb_lock->llist) and
release_async_work(work) to the top of the cleanup block. This guarantees
that the async work is completely dequeued and serialized under
conn->request_lock before locks_free_lock(flock) is called, rendering
the flock unreachable for any concurrent smb2_cancel().

Cc: stable@vger.kernel.org
Signed-off-by: Davide Ornaghi <d.ornaghi97@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index 00e63debcbe9c4060dd0dfe754d97e8dcfd7b10e..82f93b191c6c41dae5ca9e33e7c615163a99e405 100644 (file)
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -7755,29 +7755,27 @@ skip:
                                list_del(&work->fp_entry);
                                spin_unlock(&fp->f_lock);
 
-                               if (work->state != KSMBD_WORK_ACTIVE) {
-                                       list_del(&smb_lock->llist);
-                                       locks_free_lock(flock);
+                               list_del(&smb_lock->llist);
+                               release_async_work(work);
 
-                                       if (work->state == KSMBD_WORK_CANCELLED) {
-                                               rsp->hdr.Status =
-                                                       STATUS_CANCELLED;
-                                               kfree(smb_lock);
-                                               smb2_send_interim_resp(work,
-                                                                      STATUS_CANCELLED);
-                                               work->send_no_response = 1;
-                                               goto out;
-                                       }
+                               if (work->state == KSMBD_WORK_ACTIVE)
+                                       goto retry;
+
+                               locks_free_lock(flock);
 
-                                       rsp->hdr.Status =
-                                               STATUS_RANGE_NOT_LOCKED;
+                               if (work->state == KSMBD_WORK_CANCELLED) {
+                                       rsp->hdr.Status = STATUS_CANCELLED;
                                        kfree(smb_lock);
-                                       goto out2;
+                                       smb2_send_interim_resp(work,
+                                                       STATUS_CANCELLED);
+                                       work->send_no_response = 1;
+                                       goto out;
                                }
 
-                               list_del(&smb_lock->llist);
-                               release_async_work(work);
-                               goto retry;
+                               rsp->hdr.Status =
+                                       STATUS_RANGE_NOT_LOCKED;
+                               kfree(smb_lock);
+                               goto out2;
                        } else if (!rc) {
                                list_add(&smb_lock->llist, &rollback_list);
                                spin_lock(&work->conn->llist_lock);