diff options
| author | Yongjun Gwon <d3bugee@gmail.com> | 2026-10-23 02:38:32 +0900 |
|---|---|---|
| committer | Namjae Jeon <linkinjeon@kernel.org> | 2026-10-23 08:43:39 +0900 |
| commit | 7220980b2423d06a0604516129bfa4cec8a697ae (patch) | |
| tree | fd2094e691168923765830bcbe5b3ba2200c509d | |
| parent | 171df27077fb49b4af2c53ad2cedcd0e39664fe8 (diff) | |
ksmbd: serialize directory emptiness checks with readdir
SMB2 QUERY_DIRECTORY holds fp->readdir_lock while it calls iterate_dir()
on fp->filp. An SMB2 SET_INFO request with FILE_DISPOSITION_INFORMATION
can resolve the same FileId and call ksmbd_vfs_empty_dir() on the same
filp without that lock.
iterate_dir()'s inode read lock permits concurrent readers and does not
serialize per-file iterator state. ext4 stores its dx readdir cursor and
fname RB tree in file->private_data. Concurrent reset or refill can
therefore free a fname node while the other worker still traverses it or
retains its RB-tree link, resulting in use-after-free accesses.
An authenticated SMB client with list and delete rights on a directory in
a writable KSMBD share backed by ext4 can trigger this when the directory
takes the dx readdir path. The client overlaps an SMB2 QUERY_DIRECTORY
request with an SMB2 SET_INFO request carrying FILE_DISPOSITION_INFORMATION
on one live FileId.
In one x86_64 SMP KASAN multi-shot guest using ksmbd-for-next at
171df27077fb, the unmodified kernel reported a cross-worker use-after-free
before a panic. The first report's access and free stacks show the two
request paths directly (trimmed):
BUG: KASAN: slab-use-after-free in ext4_htree_store_dirent+0x488/0x550
Read of size 8 by task kworker/2:0/29
Workqueue: ksmbd-io handle_ksmbd_work
Call Trace:
ext4_htree_store_dirent+0x488/0x550
htree_dirblock_to_tree+0x535/0x990
ext4_htree_fill_tree+0x319/0xba0
ext4_readdir+0x175a/0x2f40
iterate_dir+0x1b6/0x630
smb2_query_dir+0x1003/0x1cc0
Freed by task 279:
free_rb_tree_fname+0x67/0xc0
ext4_readdir+0x13a9/0x2f40
iterate_dir+0x1b6/0x630
ksmbd_vfs_empty_dir+0xa2/0x100
smb2_set_info+0x2ffa/0x45d0
Take fp->readdir_lock across the entire emptiness check. This places both
iterators over that handle's filp in the same lock domain while
preserving the disposition status handling. The exact code change
completed a warning-free x86_64 KASAN bzImage build. Tracing three request
pairs showed that the two iterate_dir() calls no longer overlapped and the
expected statuses were preserved. A further 1,600 reproducer iterations
completed with expected statuses and no KASAN report, Oops, or panic.
The reproducer and complete guest configuration are available privately
to maintainers on request.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Yongjun Gwon <d3bugee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
| -rw-r--r-- | fs/smb/server/smb2pdu.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index da82d80c222a..f5fe3cf8ba32 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -8918,6 +8918,7 @@ static int set_file_disposition_info(struct ksmbd_work *work, struct smb2_file_disposition_info *file_info) { struct inode *inode; + int err; if (!(fp->daccess & FILE_DELETE_LE)) { pr_err("no right to delete : 0x%x\n", fp->daccess); @@ -8932,9 +8933,13 @@ static int set_file_disposition_info(struct ksmbd_work *work, if (ksmbd_has_stream_without_delete_share(fp)) return -ESHARE; - if (S_ISDIR(inode->i_mode) && !ksmbd_stream_fd(fp) && - ksmbd_vfs_empty_dir(fp) == -ENOTEMPTY) - return -EBUSY; + if (S_ISDIR(inode->i_mode) && !ksmbd_stream_fd(fp)) { + mutex_lock(&fp->readdir_lock); + err = ksmbd_vfs_empty_dir(fp); + mutex_unlock(&fp->readdir_lock); + if (err == -ENOTEMPTY) + return -EBUSY; + } smb_break_all_levII_oplock_for_delete(work, fp); ksmbd_fd_set_delete_pending(fp); } else { |