SMB2_open() accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2_parse_contexts() rejects malformed context data, SMB2_open() returns without closing the handle, leaving the server-side handle open and num_remote_opens elevated. Close the handle after a post-CREATE context parsing failure so the error path releases the remote resource and balances the open count. Fixes: af1689a9b770 ("smb: client: fix potential OOBs in smb2_parse_contexts()") Cc: stable@vger.kernel.org Reported-by: Vega Assisted-by: LLM Co-developed-by: Luxing Yin Signed-off-by: Luxing Yin Signed-off-by: Zihan Xi --- changes in v5: - Rerolled the series after fixing a NULL dereference reported by the kernel test robot Smatch analysis in patch 5: https://lore.kernel.org/r/202609241449.HlHmnZFZ-lkp@intel.com/ - v4 Link: https://lore.kernel.org/all/cover.1789478666.git.zihanx@nebusec.ai/ changes in v4: - Keep post-CREATE cleanup for parser failures and document the existing best-effort close behavior. - v3 Link: https://lore.kernel.org/all/cover.1788516372.git.zihanx@nebusec.ai/ changes in v3: - Split the POSIX handler check into a separate patch and corrected the parser Fixes history. - v2 Link: https://lore.kernel.org/all/cover.1787486936.git.zihanx@nebusec.ai/ changes in v2: - Add cleanup after a create-context parsing failure. - v1 Link: https://lore.kernel.org/all/eb1bc35611f91bd10a4772400b37fac26f660956.1782579150.git.xizh2024@lzu.edu.cn/ --- fs/smb/client/smb2pdu.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 1b2ca3b2c2f87..12973f2e26b16 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -3414,6 +3414,9 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch, oparms->fid->lease_key, oplock, file_info, posix); + if (rc) + SMB2_close(xid, tcon, oparms->fid->persistent_fid, + oparms->fid->volatile_fid); trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, oparms->create_options, oparms->desired_access, -- 2.43.0