NACK/Cmnt: [SRU][J][PATCH 1/1] ksmbd: fix use-after-free in ksmbd_sessions_deregister()

[Andrei Gherzan]

On 26/09/09 07:05PM, Cengiz Can via kernel-team wrote:
> From: Namjae Jeon <linkinjeon at kernel.org>
> 
> In multichannel mode, UAF issue can occur in session_deregister
> when the second channel sets up a session through the connection of
> the first channel. session that is freed through the global session
> table can be accessed again through ->sessions of connection.
> 
> Cc: stable at vger.kernel.org
> Reported-by: Norbert Szetei <norbert at doyensec.com>
> Tested-by: Norbert Szetei <norbert at doyensec.com>
> Signed-off-by: Namjae Jeon <linkinjeon at kernel.org>
> Signed-off-by: Steve French <stfrench at microsoft.com>
> (backported from commit 15a9605f8d69dc85005b1a00c31a050b8625e1aa)
> [bot_kybele: backported to jammy/linux; review and refine this note]

This comment needs fixing.

> CVE-2025-22041
> Assisted-by: kybele:claude-opus-4.8
> Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
> ---
>  fs/ksmbd/mgmt/user_session.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/fs/ksmbd/mgmt/user_session.c b/fs/ksmbd/mgmt/user_session.c
> index b6b6572d402d..91bf015a5d80 100644
> --- a/fs/ksmbd/mgmt/user_session.c
> +++ b/fs/ksmbd/mgmt/user_session.c
> @@ -225,6 +225,9 @@ void ksmbd_sessions_deregister(struct ksmbd_conn *conn)
>  			if (!ksmbd_chann_del(conn, sess) &&
>  			    xa_empty(&sess->ksmbd_chann_list)) {
>  				hash_del(&sess->hlist);
> +				down_write(&conn->session_lock);
> +				xa_erase(&conn->sessions, sess->id);
> +				up_write(&conn->session_lock);
>  				ksmbd_session_destroy(sess);
>  			}
>  		}

The change looks fine to me.

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260914/aa392199/attachment.sig>