Re: v5.1-rc1 cifs bug: underflow; use-after-free.

[Dominik Brodowski <linux@dominikbrodowski.net>]

On Wed, Mar 20, 2019 at 12:12:21PM +0100, Aurélien Aptel wrote:
> Dominik Brodowski <linux@dominikbrodowski.net> writes:
> > Thanks for taking a look at this issue. Fortunately, it is easily
> > reproducable (at least for me).
> 
> Which server are you doing this against? I couldn't reproduce against
> Windows Server 2016.

Had to find that out first, as I'm merely a user here: It's OES 2015 with
Samba version 3.6.3.

> >> If you enable verbose debugging [1], if my theory is correct you should
> >> see a lease break messsage followed by "clear cached root file handle"
> >> message before the warning.
> >
> > Hm, no.
> 
> Ok well I'm not sure what is happening then. But the final points still
> stand:
> 
> - since we don't free anything in the release function, there is no
>   use-after-free.
> - the access to the kref is already protected by crfid.fid_mutex so we
>   could replace it with a regular int and avoid the warning generated by
>   kref_put() that you see.  

If you have a patch ready, I can easily test that.

Thanks,
	Dominik