[PATCH v2] smb: client: fix rlist race and missing initialization

[PATCH v2] smb: client: fix rlist race and missing initialization

[Paulo Alcantara]

TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next
and ->prev to NULL instead of pointing to itself, making list_empty()
always return false and list_add() dereference a NULL ->prev pointer.

Also, cifs_signal_cifsd_for_reconnect() can be called concurrently
from multiple cifsd threads, allowing the same server's rlist node to
be added twice into the local list, corrupting it.

Closes: https://sashiko.dev/#/patchset/20260911204446.1719356-1-pc%40manguebit.org
Fixes: df0e03a4fb94 ("smb: client: fix potential deadlock when reconnecting channels")
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Cc: David Howells <dhowells@redhat.com>
Cc: Shyam Prasad N <sprasad@microsoft.com>
Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: Bharath SM <bharathsm@microsoft.com>
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: stable@vger.kernel.org
---
 fs/smb/client/connect.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
index bef710d9a3c3..4bd9f9fb93bb 100644
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -174,6 +174,8 @@ cifs_signal_cifsd_for_reconnect(struct TCP_Server_Info *server,
 				nserver = ses->chans[i].server;
 				if (!nserver)
 					continue;
+				if (!list_empty(&nserver->rlist))
+					continue;
 				nserver->srv_count++;
 				list_add(&nserver->rlist, &reco);
 			}
@@ -182,11 +184,15 @@ cifs_signal_cifsd_for_reconnect(struct TCP_Server_Info *server,
 		}
 	}
 
+	spin_lock(&cifs_tcp_ses_lock);
 	list_for_each_entry_safe(server, nserver, &reco, rlist) {
 		list_del_init(&server->rlist);
 		set_need_reco(server);
+		spin_unlock(&cifs_tcp_ses_lock);
 		cifs_put_tcp_session(server, 0);
+		spin_lock(&cifs_tcp_ses_lock);
 	}
+	spin_unlock(&cifs_tcp_ses_lock);
 }
 
 /*
@@ -1824,6 +1830,7 @@ cifs_get_tcp_session(struct smb3_fs_context *ctx,
 	spin_lock_init(&tcp_ses->mid_counter_lock);
 	INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
 	INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
+	INIT_LIST_HEAD(&tcp_ses->rlist);
 	INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
 	INIT_DELAYED_WORK(&tcp_ses->reconnect, smb2_reconnect_server);
 	mutex_init(&tcp_ses->reconnect_mutex);
-- 
2.55.0

Re: [PATCH v2] smb: client: fix rlist race and missing initialization

[Namjae Jeon]

On Sun, Sep 13, 2026 at 1:55 AM Paulo Alcantara <pc@manguebit.org> wrote:
>
> TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next
> and ->prev to NULL instead of pointing to itself, making list_empty()
> always return false and list_add() dereference a NULL ->prev pointer.
>
> Also, cifs_signal_cifsd_for_reconnect() can be called concurrently
> from multiple cifsd threads, allowing the same server's rlist node to
> be added twice into the local list, corrupting it.
>
> Closes: https://sashiko.dev/#/patchset/20260911204446.1719356-1-pc%40manguebit.org
> Fixes: df0e03a4fb94 ("smb: client: fix potential deadlock when reconnecting channels")
> Signed-off-by: Paulo Alcantara <pc@manguebit.org>
> Cc: David Howells <dhowells@redhat.com>
> Cc: Shyam Prasad N <sprasad@microsoft.com>
> Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
> Cc: Tom Talpey <tom@talpey.com>
> Cc: Bharath SM <bharathsm@microsoft.com>
> Cc: Namjae Jeon <linkinjeon@kernel.org>
> Cc: stable@vger.kernel.org
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Thanks!

Re: [PATCH v2] smb: client: fix rlist race and missing initialization

[Paulo Alcantara]

Paulo Alcantara <pc@manguebit.org> writes:

> TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next
> and ->prev to NULL instead of pointing to itself, making list_empty()
> always return false and list_add() dereference a NULL ->prev pointer.
>
> Also, cifs_signal_cifsd_for_reconnect() can be called concurrently
> from multiple cifsd threads, allowing the same server's rlist node to
> be added twice into the local list, corrupting it.
> ...

Applied.