linux-kernel - Re: [PATCH] ksmbd: ipc: fix use-after-free in ipc_msg_send

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAKYAXd9wdmE66cg-T9d=+wGAL=0qb77S7uWd7PFi40pJsd9VLg@mail.gmail.com>
Date: Wed, 26 Nov 2025 12:28:13 +0900
From: Namjae Jeon <linkinjeon@...nel.org>
To: Qianchang Zhao <pioooooooooip@...il.com>
Cc: Steve French <smfrench@...il.com>, gregkh@...uxfoundation.org, 
	linux-cifs@...r.kernel.org, linux-kernel@...r.kernel.org, 
	Zhitong Liu <liuzhitong1993@...il.com>, stable@...r.kernel.org
Subject: Re: [PATCH] ksmbd: ipc: fix use-after-free in ipc_msg_send_request

On Wed, Nov 26, 2025 at 10:49 AM Qianchang Zhao <pioooooooooip@...il.com> wrote:
>
> ipc_msg_send_request() waits for a generic netlink reply using an
> ipc_msg_table_entry on the stack. The generic netlink handler
> (handle_generic_event()/handle_response()) fills entry->response under
> ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free
> entry->response without holding the same lock.
>
> Under high concurrency this allows a race where handle_response() is
> copying data into entry->response while ipc_msg_send_request() has just
> freed it, leading to a slab-use-after-free reported by KASAN in
> handle_generic_event():
>
>   BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd]
>   Write of size 12 at addr ffff888198ee6e20 by task pool/109349
>   ...
>   Freed by task:
>     kvfree
>     ipc_msg_send_request [ksmbd]
>     ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd]
>
> Fix by:
> - Taking ipc_msg_table_lock in ipc_msg_send_request() while validating
>   entry->response, freeing it when invalid, and removing the entry from
>   ipc_msg_table.
> - Returning the final entry->response pointer to the caller only after
>   the hash entry is removed under the lock.
> - Returning NULL in the error path, preserving the original API
>   semantics.
>
> This makes all accesses to entry->response consistent with
> handle_response(), which already updates and fills the response buffer
> under ipc_msg_table_lock, and closes the race that allowed the UAF.
>
> Reported-by: Qianchang Zhao <pioooooooooip@...il.com>
> Reported-by: Zhitong Liu <liuzhitong1993@...il.com>
> Cc: stable@...r.kernel.org
> Signed-off-by: Qianchang Zhao <pioooooooooip@...il.com>
I have directly updated your patch and applied it to #ksmbd-for-next-next.
Let me know if the attached patch has some issue.
Thanks!

View attachment "0001-ksmbd-ipc-fix-use-after-free-in-ipc_msg_send_request.patch" of type "text/x-patch" (2907 bytes)