Re: [PATCH net v5 07/10] afs: Create a server appdata key

David Howells <[email protected]> Tue, 04 Aug 2026 16:46:08 +0100

Newsgroups	gmane.linux.kernel,gmane.linux.network,gmane.linux.kernel.stable
Organization	Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903
Message-ID	<[email protected]>

Simon Horman <[email protected]> wrote:

> [Severity: Critical]
> This is a pre-existing issue, but is it safe to cast and dereference peer_data
> here?
> 
> When a network CHALLENGE packet arrives and is processed in the OOB queue in
> afs_respond_to_challenge(), it reads peer_data and casts it to an afs_server
> pointer.
> 
> Since the code dereferences this pointer without holding rcu_read_lock() or
> taking a reference on the server object, what happens if the server is
> concurrently destroyed or updated?
> 
> If peer_data is set to 0, this causes a direct NULL dereference. If the
> server memory is freed, could this result in a use-after-free triggered by a
> remote attacker?

Note that the OOB code is removed by these patches.

The other two issues here need addressing, though for one of them, the fix
will need to go via the vfs tree.

David