ksmbd Vulnerability Deep Dive

Faulty Object Handling in SMB2_TREE_DISCONNECT

The Use-After-Free vulnerability occurs in the function that handles the `SMB2_TREE_DISCONNECT` command of the SMB2 protocol. The issue stems from a race condition in the management of the `ksmbd_conn` object, a core data structure used to track a client's connection state.

The incorrect sequence of operations is as follows: one thread frees the `ksmbd_conn` object but fails to nullify the pointer to it from another data structure (e.g., `ksmbd_session`). Concurrently, a second thread can access and use this old (dangling) pointer, which now points to memory that may have been reallocated for other purposes.

// Simplified code demonstrating the issue
void handle_smb2_tree_disconnect(struct ksmbd_conn *conn)
{
    struct ksmbd_session *sess = conn->session;

    mutex_lock(&sess->mutex);
    // ... clean up the tree ...

    // PROBLEM: conn is freed here while the session mutex is still held.
    // This forces other threads trying to access this session to wait.
    ksmbd_free_conn(conn); 

    // RACE CONDITION: Other pointers within the session still point to the old conn.
    // These could be used by another thread after the mutex is unlocked,
    // before the pointers have been set to NULL.
    
    mutex_unlock(&sess->mutex);
}