[PATCH] smb: client: pin DFS superblock in iterator callback

[Shyam Prasad N]

On Thu, Sep 3, 2026 at 10:27 PM Paulo Alcantara <pc at manguebit.org> wrote:
>
> Karl Mehltretter <kmehltretter at gmail.com> writes:
>
> > tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super()
> > takes its active reference only after iterate_supers_type() has dropped
> > s_umount and its passive reference. Concurrent DFS automount expiry can
> > therefore free the superblock before cifs_sb_active() uses it.
> >
> > A deterministic KASAN test reproduces the race as:
> >
> >   BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80
> >
> > The same test passes with this change applied.
> >
> > Take the active reference in the callback while iterate_supers_type()
> > still holds s_umount shared. cifs_put_tcp_super() remains the matching
> > release.
> > ...
>
> Applied.
>

I'm not sure that taking a ref on the superblock is a good idea.
Can we find a way to do this in a synchronous way in cifs_sb_kill?

-- 
Regards,
Shyam