[PATCH 2/5] cifs: do not return an invalidated cfid

nspmangalore
2025-05-02T05:15:37Z

From: Shyam Prasad N <sprasad@microsoft.com>

open_cached_dir should either return an existing valid cfid
or create a new one. Validity of cfid depends on both
cfid->has_lease and cfid->time to be true. However, if has_lease
was invalidated by a worker thread in parallel, we could end up
leaking both a dentry and a server handle.

This change checks if the entry was invalidated and returns
a -ENOENT in such a case.

Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
---
fs/smb/client/cached_dir.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c
index f074675fa6be..d307636c2679 100644
--- a/fs/smb/client/cached_dir.c
+++ b/fs/smb/client/cached_dir.c
@@ -198,9 +198,11 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon,
}

/*
+ * check again that the cfid is valid (with mutex held this time).
* Return cached fid if it is valid (has a lease and has a time).
* Otherwise, it is either a new entry or laundromat worker removed it
- * from @cfids->entries. Caller will put last reference if the latter.
+ * from @cfids->entries. If the latter, we drop the refcount and return
+ * an error to the caller.
*/
spin_lock(&cfid->fid_lock);
if (cfid->has_lease && cfid->time) {
@@ -208,6 +210,12 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon,
*ret_cfid = cfid;
kfree(utf16_path);
return 0;
+ } else if (!cfid->has_lease) {
+ spin_unlock(&cfid->fid_lock);
+ /* drop the ref that we have */
+ kref_put(&cfid->refcount, smb2_close_cached_fid);
+ kfree(utf16_path);
+ return -ENOENT;
}
spin_unlock(&cfid->fid_lock);

--
2.43.0