* [PATCH] cifs: fix panic in smb2_reconnect
@ 2019-06-03 7:31 Ronnie Sahlberg
2019-06-03 10:00 ` Aurélien Aptel
0 siblings, 1 reply; 5+ messages in thread
From: Ronnie Sahlberg @ 2019-06-03 7:31 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French, Ronnie Sahlberg
RH Bugzilla: 1702264
We need to protect so that the call to smb2_reconnect() in
smb2_reconnect_server() does not end up freeing the session
because it can lead to a use after free and crash.
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
---
fs/cifs/smb2pdu.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 565b60b62f4d..c4f3e2403b58 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3116,6 +3116,7 @@ void smb2_reconnect_server(struct work_struct *work)
if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) {
list_add_tail(&ses->tcon_ipc->rlist, &tmp_list);
tcon_exist = true;
+ ses->ses_count++;
}
}
/*
@@ -3134,6 +3135,8 @@ void smb2_reconnect_server(struct work_struct *work)
else
resched = true;
list_del_init(&tcon->rlist);
+ if (tcon->ipc)
+ cifs_put_smb_ses(tcon->ses);
cifs_put_tcon(tcon);
}
--
2.13.6
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] cifs: fix panic in smb2_reconnect
2019-06-03 7:31 [PATCH] cifs: fix panic in smb2_reconnect Ronnie Sahlberg
@ 2019-06-03 10:00 ` Aurélien Aptel
0 siblings, 0 replies; 5+ messages in thread
From: Aurélien Aptel @ 2019-06-03 10:00 UTC (permalink / raw)
To: Ronnie Sahlberg, linux-cifs; +Cc: Steve French, Ronnie Sahlberg
Ronnie Sahlberg <lsahlber@redhat.com> writes:
> diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
> index 565b60b62f4d..c4f3e2403b58 100644
> --- a/fs/cifs/smb2pdu.c
> +++ b/fs/cifs/smb2pdu.c
> @@ -3116,6 +3116,7 @@ void smb2_reconnect_server(struct work_struct *work)
I would add a comment here. Something like:
/* IPC has the same lifetime as its session and uses its
refcount */
> if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) {
> list_add_tail(&ses->tcon_ipc->rlist, &tmp_list);
> tcon_exist = true;
> + ses->ses_count++;
> }
> }
> /*
> @@ -3134,6 +3135,8 @@ void smb2_reconnect_server(struct work_struct *work)
> else
> resched = true;
> list_del_init(&tcon->rlist);
> + if (tcon->ipc)
> + cifs_put_smb_ses(tcon->ses);
> cifs_put_tcon(tcon);
Since cifs_put_tcon() is a noop on IPC this looks correct but I think an
putting it in an "else" would make the logic clearer.
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
--
Aurélien Aptel / SUSE Labs Samba Team
GPG: 1839 CB5F 9F5B FB9B AA97 8C99 03C8 A49B 521B D5D3
SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany
GF: Felix Imendörffer, Mary Higgins, Sri Rasiah HRB 21284 (AG Nürnberg)
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] cifs: fix panic in smb2_reconnect
@ 2019-06-05 0:15 Ronnie Sahlberg
2019-06-05 0:21 ` Steve French
2019-06-11 23:52 ` Pavel Shilovsky
0 siblings, 2 replies; 5+ messages in thread
From: Ronnie Sahlberg @ 2019-06-05 0:15 UTC (permalink / raw)
To: linux-cifs; +Cc: Steve French, Stable, Ronnie Sahlberg
RH Bugzilla: 1702264
We need to protect so that the call to smb2_reconnect() in
smb2_reconnect_server() does not end up freeing the session
because it can lead to a use after free and crash.
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
---
fs/cifs/smb2pdu.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 565b60b62f4d..ab8dc73d2282 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3113,9 +3113,14 @@ void smb2_reconnect_server(struct work_struct *work)
tcon_exist = true;
}
}
+ /*
+ * IPC has the same lifetime as its session and uses its
+ * refcount.
+ */
if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) {
list_add_tail(&ses->tcon_ipc->rlist, &tmp_list);
tcon_exist = true;
+ ses->ses_count++;
}
}
/*
@@ -3134,7 +3139,10 @@ void smb2_reconnect_server(struct work_struct *work)
else
resched = true;
list_del_init(&tcon->rlist);
- cifs_put_tcon(tcon);
+ if (tcon->ipc)
+ cifs_put_smb_ses(tcon->ses);
+ else
+ cifs_put_tcon(tcon);
}
cifs_dbg(FYI, "Reconnecting tcons finished\n");
--
2.13.6
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] cifs: fix panic in smb2_reconnect
2019-06-05 0:15 Ronnie Sahlberg
@ 2019-06-05 0:21 ` Steve French
2019-06-11 23:52 ` Pavel Shilovsky
1 sibling, 0 replies; 5+ messages in thread
From: Steve French @ 2019-06-05 0:21 UTC (permalink / raw)
To: Ronnie Sahlberg; +Cc: linux-cifs, Stable
tentatively merged into cifs-2.6.git for-next (and to the github tree
for next buildbot run)
On Tue, Jun 4, 2019 at 7:15 PM Ronnie Sahlberg <lsahlber@redhat.com> wrote:
>
> RH Bugzilla: 1702264
>
> We need to protect so that the call to smb2_reconnect() in
> smb2_reconnect_server() does not end up freeing the session
> because it can lead to a use after free and crash.
>
> Reviewed-by: Aurelien Aptel <aaptel@suse.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
> ---
> fs/cifs/smb2pdu.c | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
> index 565b60b62f4d..ab8dc73d2282 100644
> --- a/fs/cifs/smb2pdu.c
> +++ b/fs/cifs/smb2pdu.c
> @@ -3113,9 +3113,14 @@ void smb2_reconnect_server(struct work_struct *work)
> tcon_exist = true;
> }
> }
> + /*
> + * IPC has the same lifetime as its session and uses its
> + * refcount.
> + */
> if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) {
> list_add_tail(&ses->tcon_ipc->rlist, &tmp_list);
> tcon_exist = true;
> + ses->ses_count++;
> }
> }
> /*
> @@ -3134,7 +3139,10 @@ void smb2_reconnect_server(struct work_struct *work)
> else
> resched = true;
> list_del_init(&tcon->rlist);
> - cifs_put_tcon(tcon);
> + if (tcon->ipc)
> + cifs_put_smb_ses(tcon->ses);
> + else
> + cifs_put_tcon(tcon);
> }
>
> cifs_dbg(FYI, "Reconnecting tcons finished\n");
> --
> 2.13.6
>
--
Thanks,
Steve
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] cifs: fix panic in smb2_reconnect
2019-06-05 0:15 Ronnie Sahlberg
2019-06-05 0:21 ` Steve French
@ 2019-06-11 23:52 ` Pavel Shilovsky
1 sibling, 0 replies; 5+ messages in thread
From: Pavel Shilovsky @ 2019-06-11 23:52 UTC (permalink / raw)
To: Ronnie Sahlberg; +Cc: linux-cifs, Steve French, Stable
вт, 4 июн. 2019 г. в 17:16, Ronnie Sahlberg <lsahlber@redhat.com>:
>
> RH Bugzilla: 1702264
>
> We need to protect so that the call to smb2_reconnect() in
> smb2_reconnect_server() does not end up freeing the session
> because it can lead to a use after free and crash.
>
> Reviewed-by: Aurelien Aptel <aaptel@suse.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
> ---
> fs/cifs/smb2pdu.c | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
> index 565b60b62f4d..ab8dc73d2282 100644
> --- a/fs/cifs/smb2pdu.c
> +++ b/fs/cifs/smb2pdu.c
> @@ -3113,9 +3113,14 @@ void smb2_reconnect_server(struct work_struct *work)
> tcon_exist = true;
> }
> }
> + /*
> + * IPC has the same lifetime as its session and uses its
> + * refcount.
> + */
> if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) {
> list_add_tail(&ses->tcon_ipc->rlist, &tmp_list);
> tcon_exist = true;
> + ses->ses_count++;
> }
> }
> /*
> @@ -3134,7 +3139,10 @@ void smb2_reconnect_server(struct work_struct *work)
> else
> resched = true;
> list_del_init(&tcon->rlist);
> - cifs_put_tcon(tcon);
> + if (tcon->ipc)
> + cifs_put_smb_ses(tcon->ses);
> + else
> + cifs_put_tcon(tcon);
> }
>
> cifs_dbg(FYI, "Reconnecting tcons finished\n");
> --
> 2.13.6
>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
--
Best regards,
Pavel Shilovsky
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2019-06-11 23:52 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-06-03 7:31 [PATCH] cifs: fix panic in smb2_reconnect Ronnie Sahlberg
2019-06-03 10:00 ` Aurélien Aptel
-- strict thread matches above, loose matches on Subject: below --
2019-06-05 0:15 Ronnie Sahlberg
2019-06-05 0:21 ` Steve French
2019-06-11 23:52 ` Pavel Shilovsky
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox