CVE-2024-53186: ksmbd: fix use-after-free in SMB request handling

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in SMB request handling

A race condition exists between SMB request handling in ksmbdconnhandlerloop() and the freeing of ksmbdconn in the workqueue handler handleksmbdwork(). This leads to a UAF. - KASAN: slab-use-after-free Read in handleksmbdwork - KASAN: slab-use-after-free in rtlockslowlocklocked

This race condition arises as follows: - ksmbdconnhandlerloop() waits for conn->rcount to reach zero: waitevent(conn->rcountq, atomicread(&conn->rcount) == 0); - Meanwhile, handleksmbdwork() decrements conn->rcount using atomicdecreturn(&conn->rcount), and if it reaches zero, calls ksmbdconnfree(), which frees conn. - However, after handleksmbdwork() decrements conn->rcount, it may still access conn->rcountq in the following line: waitqueueactive(&conn->rcountq) or wakeup(&conn->rcountq) This results in a UAF, as conn has already been freed.

The discovery of this UAF can be referenced in the following PR for syzkaller's support for SMB requests.