diff options
| author | Ronnie Sahlberg <lsahlber@redhat.com> | 2019-06-05 02:15:34 +0200 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2019-06-13 21:20:57 +0200 |
| commit | 0ff2b018b02f89da26a616e0148582321a00fd99 (patch) | |
| tree | a7a1183c2a7bd64549df35becdb522e62b5f0d92 /fs | |
| parent | Linux 5.2-rc4 (diff) | |
| download | linux-0ff2b018b02f89da26a616e0148582321a00fd99.tar.xz linux-0ff2b018b02f89da26a616e0148582321a00fd99.zip | |
cifs: fix panic in smb2_reconnect
RH Bugzilla: 1702264
We need to protect so that the call to smb2_reconnect() in
smb2_reconnect_server() does not end up freeing the session
because it can lead to a use after free and crash.
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/cifs/smb2pdu.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 29b699d532ef..75311a8a68bf 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -3114,9 +3114,14 @@ void smb2_reconnect_server(struct work_struct *work) tcon_exist = true; } } + /* + * IPC has the same lifetime as its session and uses its + * refcount. + */ if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); tcon_exist = true; + ses->ses_count++; } } /* @@ -3135,7 +3140,10 @@ void smb2_reconnect_server(struct work_struct *work) else resched = true; list_del_init(&tcon->rlist); - cifs_put_tcon(tcon); + if (tcon->ipc) + cifs_put_smb_ses(tcon->ses); + else + cifs_put_tcon(tcon); } cifs_dbg(FYI, "Reconnecting tcons finished\n"); |