RE: [PATCH] ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

[Werner Kasselman]

I sent an earlier version of the patch by mistake. The version with the complete changes (including alloc_lease_table() split and add_lease_global_list() signature change) was committed locally but the email went out before the final amend. I apologise for the confusion.

I will resend the correct patch as v2. The full diff is +45/-27 lines and includes:
 - New alloc_lease_table() helper (extracted from add_lease_global_list)
 - add_lease_global_list() changed to take preallocated lease_table, return type changed from int to void
 - smb_grant_oplock() restructured: set o_fp, preallocate, then publish
 - Error path uses opinfo_put() instead of __free_opinfo()

Kind regards,
Werner

-----Original Message-----
From: ChenXiaoSong <chenxiaosong@xxxxxxxxxxxxxxxx> 
Sent: Tuesday, 17 March 2026 4:33 PM
To: Werner Kasselman <werner@xxxxxxxxxx>; linux-cifs@xxxxxxxxxxxxxxx
Cc: linkinjeon@xxxxxxxxxx; smfrench@xxxxxxxxx; senozhatsky@xxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; stable@xxxxxxxxxxxxxxx
Subject: Re: [PATCH] ksmbd: fix use-after-free and NULL deref in smb_grant_oplock()

Hi Werner,

Thanks for your patch. It seems the changes below are not included. Do you have any follow-up patches that haven't been submitted yet?

Thanks,
ChenXiaoSong <chenxiaosong@xxxxxxxxxxxxxxxx>

在 2026/3/17 10:18, Werner Kasselman 写道:
> - Preallocate lease_table via alloc_lease_table() before opinfo_add()
>    so add_lease_global_list() becomes infallible after publication.
> - Keep the original m_op_list publication order (opinfo_add before
>    lease list) so concurrent opens via same_client_has_lease() and
>    opinfo_get_list() still see the in-flight grant.
> - Use opinfo_put() instead of __free_opinfo() on err_out so that
>    the RCU-deferred free path is used.
> 
> This also requires splitting add_lease_global_list() to take a 
> preallocated lease_table and changing its return type from int to 
> void, since it can no longer fail.