xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cifs: missed ref-counting smb session in find

Browse Source 
[ Upstream commit e695a9ad0305af6e8b0cbc24a54976ac2120cbb3 ]

When we lookup an smb session based on session id,
we did not up the ref-count for the session. This can
potentially cause issues if the session is freed from under us.

Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: 02c418774f76 ("smb: client: fix deadlock in smb2_find_smb_tcon()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Shyam Prasad N
2021-05-23 16:54:42 +00:00
committed by Greg Kroah-Hartman
parent b03555a8fa
commit 78ebec450e
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
fs/cifs/smb2transport.c
View File

@@ -154,6 +154,7 @@ smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id)
list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
if (ses->Suid != ses_id) if (ses->Suid != ses_id)
continue; continue;
++ses->ses_count;
return ses; return ses;
} }
@@ -205,7 +206,14 @@ smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid)
return NULL; return NULL;
} }
tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid); tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid);
if (!tcon) {
cifs_put_smb_ses(ses);
spin_unlock(&cifs_tcp_ses_lock); spin_unlock(&cifs_tcp_ses_lock);
return NULL;
}
spin_unlock(&cifs_tcp_ses_lock);
/* tcon already has a ref to ses, so we don't need ses anymore */
cifs_put_smb_ses(ses);
return tcon; return tcon;
} }
@@ -239,7 +247,7 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server,
if (rc) { if (rc) {
cifs_server_dbg(VFS, cifs_server_dbg(VFS,
"%s: sha256 alloc failed\n", __func__); "%s: sha256 alloc failed\n", __func__);
return rc; goto out;
} }
shash = &sdesc->shash; shash = &sdesc->shash;
} else { } else {
@@ -290,6 +298,8 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server,
out: out:
if (allocate_crypto) if (allocate_crypto)
cifs_free_hash(&hash, &sdesc); cifs_free_hash(&hash, &sdesc);
if (ses)
cifs_put_smb_ses(ses);
return rc; return rc;
} }