Re: [PATCH] ksmbd: fix use-after-free in same_client_has_lease()

[Namjae Jeon]

On Fri, Jun 5, 2026 at 1:30 PM Guangshuo Li <lgs201920130244@xxxxxxxxx> wrote:
>
> same_client_has_lease() returns an opinfo pointer from ci->m_op_list
> after dropping ci->m_lock without taking a reference.
>
> smb_grant_oplock() then dereferences that pointer in copy_lease() and
> when checking breaking_cnt. A concurrent close can remove the old lease
> from ci->m_op_list and drop the last reference before the caller uses
> the returned pointer, leading to a use-after-free.
>
> Take a reference when same_client_has_lease() selects an existing lease,
> drop any previous match while scanning, and release the returned
> reference in smb_grant_oplock() after copying the lease state.
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
Applied it to #ksmbd-for-next-next.
Thanks!