From: Dan Carpenter <error27@gmail.com>
To: oe-kbuild@lists.linux.dev, cros-kernel-buildreports@googlegroups.com
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev
Subject: [chrome-os:chromeos-6.1 18/18] fs/smb/client/sess.c:310 cifs_disable_secondary_channels() error: dereferencing freed memory 'iface' (line 308)
Date: Fri, 2 Oct 2026 08:06:23 +0300 [thread overview]
Message-ID: <202610020116.n8KvKthY-lkp@intel.com> (raw)
tree: https://chromium.googlesource.com/chromiumos/third_party/kernel chromeos-6.1
head: e2d429338ffa976942aba4887d0b8a7e07dc0267
commit: e341b7975bd72d3ebda92b8d747d0aad15ce8717 [18/18] cifs: handle when server stops supporting multichannel
config: x86_64-randconfig-2200-20261001 (https://download.01.org/0day-ci/archive/20261002/202610020116.n8KvKthY-lkp@intel.com/config)
compiler: clang version 22.1.8 (https://github.com/llvm/llvm-project ca7933e47d3a3451d81e72ac174dcb5aa28b59d1)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202610020116.n8KvKthY-lkp@intel.com/
smatch warnings:
fs/smb/client/sess.c:310 cifs_disable_secondary_channels() error: dereferencing freed memory 'iface' (line 308)
vim +/iface +310 fs/smb/client/sess.c
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 285 void
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 286 cifs_disable_secondary_channels(struct cifs_ses *ses)
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 287 {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 288 int i, chan_count;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 289 struct TCP_Server_Info *server;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 290 struct cifs_server_iface *iface;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 291
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 292 spin_lock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 293 chan_count = ses->chan_count;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 294 if (chan_count == 1)
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 295 goto done;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 296
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 297 ses->chan_count = 1;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 298
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 299 /* for all secondary channels reset the need reconnect bit */
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 300 ses->chans_need_reconnect &= 1;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 301
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 302 for (i = 1; i < chan_count; i++) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 303 iface = ses->chans[i].iface;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 304 server = ses->chans[i].server;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 305
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 306 if (iface) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 307 spin_lock(&ses->iface_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 @308 kref_put(&iface->refcount, release_iface);
^^^^^^^^^^^^^
iface released
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 309 ses->chans[i].iface = NULL;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 @310 iface->num_channels--;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 311 if (iface->weight_fulfilled)
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 312 iface->weight_fulfilled--;
and then dereferenced. Use after free.
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 313 spin_unlock(&ses->iface_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 314 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 315
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 316 spin_unlock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 317 if (server && !server->terminate) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 318 server->terminate = true;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 319 cifs_signal_cifsd_for_reconnect(server, false);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 320 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 321 spin_lock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 322
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 323 if (server) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 324 ses->chans[i].server = NULL;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 325 cifs_put_tcp_session(server, false);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 326 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 327
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 328 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 329
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 330 done:
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 331 spin_unlock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 332 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
WARNING: multiple messages have this Message-ID (diff)
From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [chrome-os:chromeos-6.1 18/18] fs/smb/client/sess.c:310 cifs_disable_secondary_channels() error: dereferencing freed memory 'iface' (line 308)
Date: Fri, 02 Oct 2026 01:52:51 +0200 [thread overview]
Message-ID: <202610020116.n8KvKthY-lkp@intel.com> (raw)
Unfiltered warning: this smatch report is sent as-is and has not been
reviewed for false positives, so please treat it with due skepticism.
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: cros-kernel-buildreports@googlegroups.com
tree: https://chromium.googlesource.com/chromiumos/third_party/kernel chromeos-6.1
head: e2d429338ffa976942aba4887d0b8a7e07dc0267
commit: e341b7975bd72d3ebda92b8d747d0aad15ce8717 [18/18] cifs: handle when server stops supporting multichannel
:::::: branch date: 11 hours ago
:::::: commit date: 10 weeks ago
config: x86_64-randconfig-2200-20261001 (https://download.01.org/0day-ci/archive/20261002/202610020116.n8KvKthY-lkp@intel.com/config)
compiler: clang version 22.1.8 (https://github.com/llvm/llvm-project ca7933e47d3a3451d81e72ac174dcb5aa28b59d1)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202610020116.n8KvKthY-lkp@intel.com/
smatch warnings:
fs/smb/client/sess.c:310 cifs_disable_secondary_channels() error: dereferencing freed memory 'iface' (line 308)
vim +/iface +310 fs/smb/client/sess.c
d70e9fa5588476 fs/cifs/sess.c Aurelien Aptel 2019-09-20 279
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 280 /*
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 281 * called when multichannel is disabled by the server.
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 282 * this always gets called from smb2_reconnect
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 283 * and cannot get called in parallel threads.
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 284 */
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 285 void
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 286 cifs_disable_secondary_channels(struct cifs_ses *ses)
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 287 {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 288 int i, chan_count;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 289 struct TCP_Server_Info *server;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 290 struct cifs_server_iface *iface;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 291
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 292 spin_lock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 293 chan_count = ses->chan_count;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 294 if (chan_count == 1)
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 295 goto done;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 296
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 297 ses->chan_count = 1;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 298
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 299 /* for all secondary channels reset the need reconnect bit */
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 300 ses->chans_need_reconnect &= 1;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 301
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 302 for (i = 1; i < chan_count; i++) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 303 iface = ses->chans[i].iface;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 304 server = ses->chans[i].server;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 305
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 306 if (iface) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 307 spin_lock(&ses->iface_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 @308 kref_put(&iface->refcount, release_iface);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 309 ses->chans[i].iface = NULL;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 @310 iface->num_channels--;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 311 if (iface->weight_fulfilled)
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 312 iface->weight_fulfilled--;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 313 spin_unlock(&ses->iface_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 314 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 315
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 316 spin_unlock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 317 if (server && !server->terminate) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 318 server->terminate = true;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 319 cifs_signal_cifsd_for_reconnect(server, false);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 320 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 321 spin_lock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 322
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 323 if (server) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 324 ses->chans[i].server = NULL;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 325 cifs_put_tcp_session(server, false);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 326 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 327
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 328 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 329
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 330 done:
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 331 spin_unlock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 332 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 333
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-10-02 5:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-01 23:52 kernel test robot [this message]
2026-10-02 5:06 ` [chrome-os:chromeos-6.1 18/18] fs/smb/client/sess.c:310 cifs_disable_secondary_channels() error: dereferencing freed memory 'iface' (line 308) Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202610020116.n8KvKthY-lkp@intel.com \
--to=error27@gmail.com \
--cc=cros-kernel-buildreports@googlegroups.com \
--cc=lkp@intel.com \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.