A bad SMB server could free a buffer the client still uses
Brief
This is not the offset-write hole.
Notes
730d0bb19507 (Frank Sorenson) landed via the same cifs-fixes-7.3-rc1 merge. SMB1 client multi-part use-after-free. You have to mount that server. The helper lives in smb1ops.c on kernels before 7.0. Fixes ancestor 316cf94a910f. Cc:stable.
Not the in-kernel SMB server card 153963ac.
Commit 730d0bb19507b9e19c2fe5343109ac618e2fbce5