* [chrome-os:chromeos-6.1 18/18] fs/smb/client/sess.c:310 cifs_disable_secondary_channels() error: dereferencing freed memory 'iface' (line 308)
@ 2026-10-02 5:06 ` Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: kernel test robot @ 2026-10-01 23:52 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
Unfiltered warning: this smatch report is sent as-is and has not been
reviewed for false positives, so please treat it with due skepticism.
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: cros-kernel-buildreports@googlegroups.com
tree: https://chromium.googlesource.com/chromiumos/third_party/kernel chromeos-6.1
head: e2d429338ffa976942aba4887d0b8a7e07dc0267
commit: e341b7975bd72d3ebda92b8d747d0aad15ce8717 [18/18] cifs: handle when server stops supporting multichannel
:::::: branch date: 11 hours ago
:::::: commit date: 10 weeks ago
config: x86_64-randconfig-2200-20261001 (https://download.01.org/0day-ci/archive/20261002/202610020116.n8KvKthY-lkp@intel.com/config)
compiler: clang version 22.1.8 (https://github.com/llvm/llvm-project ca7933e47d3a3451d81e72ac174dcb5aa28b59d1)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202610020116.n8KvKthY-lkp@intel.com/
smatch warnings:
fs/smb/client/sess.c:310 cifs_disable_secondary_channels() error: dereferencing freed memory 'iface' (line 308)
vim +/iface +310 fs/smb/client/sess.c
d70e9fa5588476 fs/cifs/sess.c Aurelien Aptel 2019-09-20 279
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 280 /*
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 281 * called when multichannel is disabled by the server.
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 282 * this always gets called from smb2_reconnect
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 283 * and cannot get called in parallel threads.
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 284 */
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 285 void
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 286 cifs_disable_secondary_channels(struct cifs_ses *ses)
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 287 {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 288 int i, chan_count;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 289 struct TCP_Server_Info *server;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 290 struct cifs_server_iface *iface;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 291
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 292 spin_lock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 293 chan_count = ses->chan_count;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 294 if (chan_count == 1)
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 295 goto done;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 296
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 297 ses->chan_count = 1;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 298
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 299 /* for all secondary channels reset the need reconnect bit */
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 300 ses->chans_need_reconnect &= 1;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 301
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 302 for (i = 1; i < chan_count; i++) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 303 iface = ses->chans[i].iface;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 304 server = ses->chans[i].server;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 305
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 306 if (iface) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 307 spin_lock(&ses->iface_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 @308 kref_put(&iface->refcount, release_iface);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 309 ses->chans[i].iface = NULL;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 @310 iface->num_channels--;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 311 if (iface->weight_fulfilled)
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 312 iface->weight_fulfilled--;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 313 spin_unlock(&ses->iface_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 314 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 315
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 316 spin_unlock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 317 if (server && !server->terminate) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 318 server->terminate = true;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 319 cifs_signal_cifsd_for_reconnect(server, false);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 320 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 321 spin_lock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 322
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 323 if (server) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 324 ses->chans[i].server = NULL;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 325 cifs_put_tcp_session(server, false);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 326 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 327
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 328 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 329
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 330 done:
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 331 spin_unlock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 332 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 333
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 2+ messages in thread
* [chrome-os:chromeos-6.1 18/18] fs/smb/client/sess.c:310 cifs_disable_secondary_channels() error: dereferencing freed memory 'iface' (line 308)
@ 2026-10-02 5:06 ` Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2026-10-02 5:06 UTC (permalink / raw)
To: oe-kbuild, cros-kernel-buildreports; +Cc: lkp, oe-kbuild-all
tree: https://chromium.googlesource.com/chromiumos/third_party/kernel chromeos-6.1
head: e2d429338ffa976942aba4887d0b8a7e07dc0267
commit: e341b7975bd72d3ebda92b8d747d0aad15ce8717 [18/18] cifs: handle when server stops supporting multichannel
config: x86_64-randconfig-2200-20261001 (https://download.01.org/0day-ci/archive/20261002/202610020116.n8KvKthY-lkp@intel.com/config)
compiler: clang version 22.1.8 (https://github.com/llvm/llvm-project ca7933e47d3a3451d81e72ac174dcb5aa28b59d1)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202610020116.n8KvKthY-lkp@intel.com/
smatch warnings:
fs/smb/client/sess.c:310 cifs_disable_secondary_channels() error: dereferencing freed memory 'iface' (line 308)
vim +/iface +310 fs/smb/client/sess.c
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 285 void
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 286 cifs_disable_secondary_channels(struct cifs_ses *ses)
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 287 {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 288 int i, chan_count;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 289 struct TCP_Server_Info *server;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 290 struct cifs_server_iface *iface;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 291
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 292 spin_lock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 293 chan_count = ses->chan_count;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 294 if (chan_count == 1)
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 295 goto done;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 296
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 297 ses->chan_count = 1;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 298
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 299 /* for all secondary channels reset the need reconnect bit */
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 300 ses->chans_need_reconnect &= 1;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 301
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 302 for (i = 1; i < chan_count; i++) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 303 iface = ses->chans[i].iface;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 304 server = ses->chans[i].server;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 305
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 306 if (iface) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 307 spin_lock(&ses->iface_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 @308 kref_put(&iface->refcount, release_iface);
^^^^^^^^^^^^^
iface released
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 309 ses->chans[i].iface = NULL;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 @310 iface->num_channels--;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 311 if (iface->weight_fulfilled)
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 312 iface->weight_fulfilled--;
and then dereferenced. Use after free.
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 313 spin_unlock(&ses->iface_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 314 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 315
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 316 spin_unlock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 317 if (server && !server->terminate) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 318 server->terminate = true;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 319 cifs_signal_cifsd_for_reconnect(server, false);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 320 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 321 spin_lock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 322
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 323 if (server) {
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 324 ses->chans[i].server = NULL;
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 325 cifs_put_tcp_session(server, false);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 326 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 327
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 328 }
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 329
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 330 done:
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 331 spin_unlock(&ses->chan_lock);
e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 332 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-02 5:06 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-01 23:52 [chrome-os:chromeos-6.1 18/18] fs/smb/client/sess.c:310 cifs_disable_secondary_channels() error: dereferencing freed memory 'iface' (line 308) kernel test robot
2026-10-02 5:06 ` Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.