[bug report] cifs: serialize initialization and cleanup of cfid

[Dan Carpenter <dan.carpenter@linaro.org>]

Hello Shyam Prasad N,

Commit 62adfb82c199 ("cifs: serialize initialization and cleanup of
cfid") from Apr 29, 2025 (linux-next), leads to the following Smatch
static checker warning:

	fs/smb/client/cached_dir.c:474 smb2_close_cached_fid()
	warn: 'cfid' was already freed. (line 473)

fs/smb/client/cached_dir.c
    441 static void
    442 smb2_close_cached_fid(struct kref *ref)
    443 {
    444         struct cached_fid *cfid = container_of(ref, struct cached_fid,
    445                                                refcount);
    446         int rc;
    447 
    448         /* make sure not to race with server open */
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

    449         mutex_lock(&cfid->cfid_mutex);
    450 
    451         spin_lock(&cfid->cfids->cfid_list_lock);
    452         if (cfid->on_list) {
    453                 list_del(&cfid->entry);
    454                 cfid->on_list = false;
    455                 cfid->cfids->num_entries--;
    456         }
    457         spin_unlock(&cfid->cfids->cfid_list_lock);
    458 
    459         /* no locking necessary as we're the last user of this cfid */
    460         if (cfid->dentry) {
    461                 dput(cfid->dentry);
    462                 cfid->dentry = NULL;
    463         }
    464 
    465         if (cfid->is_open) {
    466                 rc = SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid,
    467                            cfid->fid.volatile_fid);
    468                 if (rc) /* should we retry on -EBUSY or -EAGAIN? */
    469                         cifs_dbg(VFS, "close cached dir rc %d\n", rc);
    470         }
    471 
    472         free_cached_dir(cfid);
                                ^^^^
This frees "cfid".

    473         mutex_unlock(&cfid->cfid_mutex);

If there is something waiting on this lock then it's a use after free on
the waiter side as well.  Maybe this should be reference counted?

--> 474 }

regards,
dan carpenter