ksmbd DurableReconnect UAF

Vulnerability analysis

The vulnerability is a use-after-free in smb2_open() within the ksmbd kernel SMB2 server. During a durable handle reconnect, ksmbd_put_durable_fd(dh_info.fp) was called at multiple early points inside the reconnected block (after smb2_check_durable_oplock, ksmbd_reopen_durable_fd, ksmbd_override_fsids, and after ksmbd_vfs_getattr). After the reference drop, the function continues to use the fp pointer to build responses and handle errors. If an error occurs subsequently (e.g., ksmbd_iov_pin_rsp fails) or a scavenger thread frees the object, the kernel accesses freed fp properties such as fp->create_time and fp->filp, constituting a use-after-free. The fix consolidates the single ksmbd_put_durable_fd call to the end of the function at err_out2, guarded by dh_info.reconnected, ensuring fp remains valid for the entire duration of smb2_open. The attack surface is the SMB2 network protocol: any authenticated client can initiate a durable reconnect request, and the premature put leaves a dangling pointer that is accessed on later success or error paths.