CVE-2025-40039

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: Fix race condition in RPC handle list access

The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd

session. Access to this list is intended to be protected by

'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was

flawed, leading to potential race conditions.

In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock

before calling xa_store() and xa_erase(). Since these operations modify

the XArray structure, a write lock is required to ensure exclusive access

and prevent data corruption from concurrent modifications.

Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load()

without holding any lock at all. This could lead to reading inconsistent

data or a potential use-after-free if an entry is concurrently removed and

the pointer is dereferenced.

Fix these issues by:

1. Using down_write() and up_write() in ksmbd_session_rpc_open()

to ensure exclusive access during XArray modification, and ensuring

the lock is correctly released on error paths.

2. Adding down_read() and up_read() in ksmbd_session_rpc_method()

to safely protect the lookup.