From: Namjae Jeon <linkinjeon@kernel.org>
To: Joshua Klinesmith <joshuaklinesmith@gmail.com>
Cc: samba-technical@lists.samba.org, linux-cifs@vger.kernel.org
Subject: Re: [PATCH] ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine
Date: Tue, 7 Apr 2026 20:58:20 +0900 [thread overview]
Message-ID: <CAKYAXd_sg7DjjARDz-UZCbotDqzJDm3b6VyK5OLrnYCC4kBY-g@mail.gmail.com> (raw)
In-Reply-To: <20260407023112.51220-1-joshuaklinesmith@gmail.com>
On Tue, Apr 7, 2026 at 11:31 AM Joshua Klinesmith
<joshuaklinesmith@gmail.com> wrote:
>
> ksmbd_crypt_message() sets a NULL completion callback on AEAD requests
> and does not handle the -EINPROGRESS return code from async hardware
> crypto engines like the Qualcomm Crypto Engine (QCE). When QCE returns
> -EINPROGRESS, ksmbd treats it as an error and immediately frees the
> request while the hardware DMA operation is still in flight. The DMA
> completion callback then dereferences freed memory, causing a NULL
> pointer crash:
>
> pc : qce_skcipher_done+0x24/0x174
> lr : vchan_complete+0x230/0x27c
> ...
> el1h_64_irq+0x68/0x6c
> ksmbd_free_work_struct+0x20/0x118 [ksmbd]
> ksmbd_exit_file_cache+0x694/0xa4c [ksmbd]
>
> Use the standard crypto_wait_req() pattern with crypto_req_done() as
> the completion callback, matching the approach used by the SMB client
> in fs/smb/client/smb2ops.c. This properly handles both synchronous
> engines (immediate return) and async engines (-EINPROGRESS followed
> by callback notification).
>
> Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
> Link: https://github.com/openwrt/openwrt/issues/21822
> Signed-off-by: Joshua Klinesmith <joshuaklinesmith@gmail.com>
Applied it to #ksmbd-for-next-next.
Thanks!
next prev parent reply other threads:[~2026-04-07 11:58 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-07 2:31 [PATCH] ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine Joshua Klinesmith
2026-04-07 11:58 ` Namjae Jeon [this message]
-- strict thread matches above, loose matches on Subject: below --
2026-04-07 2:32 Joshua Klinesmith
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAKYAXd_sg7DjjARDz-UZCbotDqzJDm3b6VyK5OLrnYCC4kBY-g@mail.gmail.com \
--to=linkinjeon@kernel.org \
--cc=joshuaklinesmith@gmail.com \
--cc=linux-cifs@vger.kernel.org \
--cc=samba-technical@lists.samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).