[bug report] cifs: serialize initialization and cleanup of cfid

[bug report] cifs: serialize initialization and cleanup of cfid

[Dan Carpenter]

Hello Shyam Prasad N,

Commit 62adfb82c199 ("cifs: serialize initialization and cleanup of
cfid") from Apr 29, 2025 (linux-next), leads to the following Smatch
static checker warning:

	fs/smb/client/cached_dir.c:474 smb2_close_cached_fid()
	warn: 'cfid' was already freed. (line 473)

fs/smb/client/cached_dir.c
    441 static void
    442 smb2_close_cached_fid(struct kref *ref)
    443 {
    444         struct cached_fid *cfid = container_of(ref, struct cached_fid,
    445                                                refcount);
    446         int rc;
    447 
    448         /* make sure not to race with server open */
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

    449         mutex_lock(&cfid->cfid_mutex);
    450 
    451         spin_lock(&cfid->cfids->cfid_list_lock);
    452         if (cfid->on_list) {
    453                 list_del(&cfid->entry);
    454                 cfid->on_list = false;
    455                 cfid->cfids->num_entries--;
    456         }
    457         spin_unlock(&cfid->cfids->cfid_list_lock);
    458 
    459         /* no locking necessary as we're the last user of this cfid */
    460         if (cfid->dentry) {
    461                 dput(cfid->dentry);
    462                 cfid->dentry = NULL;
    463         }
    464 
    465         if (cfid->is_open) {
    466                 rc = SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid,
    467                            cfid->fid.volatile_fid);
    468                 if (rc) /* should we retry on -EBUSY or -EAGAIN? */
    469                         cifs_dbg(VFS, "close cached dir rc %d\n", rc);
    470         }
    471 
    472         free_cached_dir(cfid);
                                ^^^^
This frees "cfid".

    473         mutex_unlock(&cfid->cfid_mutex);

If there is something waiting on this lock then it's a use after free on
the waiter side as well.  Maybe this should be reference counted?

--> 474 }

regards,
dan carpenter

[bug report] cifs: serialize initialization and cleanup of cfid

[Dan Carpenter]

Hello Shyam Prasad N,

Commit 62adfb82c199 ("cifs: serialize initialization and cleanup of
cfid") from Apr 29, 2025 (linux-next), leads to the following Smatch
static checker warning:

	fs/smb/client/cached_dir.c:492 drop_cached_dir_by_name()
	warn: sleeping in atomic context

fs/smb/client/cached_dir.c
    476 void drop_cached_dir_by_name(const unsigned int xid, struct cifs_tcon *tcon,
    477                              const char *name, struct cifs_sb_info *cifs_sb)
    478 {
    479         struct cached_fid *cfid = NULL;
    480         int rc;
    481 
    482         rc = open_cached_dir(xid, tcon, name, cifs_sb, true, &cfid);
    483         if (rc) {
    484                 cifs_dbg(FYI, "no cached dir found for rmdir(%s)\n", name);
    485                 return;
    486         }
    487         spin_lock(&cfid->fid_lock);
                ^^^^^^^^^^^^^^^^^^^^^^^^^^
    488         if (cfid->has_lease) {
    489                 /* mark as invalid */
    490                 cfid->has_lease = false;
    491                 kref_put(&cfid->refcount, smb2_close_cached_fid);
                                                  ^^^^^^^^^^^^^^^^^^^^^^
The patch adds mutex but the issue is that drop_cached_dir_by_name()
is holding a spinlock and we can't take a mutex if we're already holding
a spinlock.

--> 492         }
    493         spin_unlock(&cfid->fid_lock);
    494         close_cached_dir(cfid);
    495 }

regards,
dan carpenter

Re: [bug report] cifs: serialize initialization and cleanup of cfid

[Shyam Prasad N]

On Mon, May 5, 2025 at 7:57 PM Dan Carpenter <dan.carpenter@linaro.org> wrote:
>
> Hello Shyam Prasad N,
>
> Commit 62adfb82c199 ("cifs: serialize initialization and cleanup of
> cfid") from Apr 29, 2025 (linux-next), leads to the following Smatch
> static checker warning:
>
>         fs/smb/client/cached_dir.c:492 drop_cached_dir_by_name()
>         warn: sleeping in atomic context
>
> fs/smb/client/cached_dir.c
>     476 void drop_cached_dir_by_name(const unsigned int xid, struct cifs_tcon *tcon,
>     477                              const char *name, struct cifs_sb_info *cifs_sb)
>     478 {
>     479         struct cached_fid *cfid = NULL;
>     480         int rc;
>     481
>     482         rc = open_cached_dir(xid, tcon, name, cifs_sb, true, &cfid);
>     483         if (rc) {
>     484                 cifs_dbg(FYI, "no cached dir found for rmdir(%s)\n", name);
>     485                 return;
>     486         }
>     487         spin_lock(&cfid->fid_lock);
>                 ^^^^^^^^^^^^^^^^^^^^^^^^^^
>     488         if (cfid->has_lease) {
>     489                 /* mark as invalid */
>     490                 cfid->has_lease = false;
>     491                 kref_put(&cfid->refcount, smb2_close_cached_fid);
>                                                   ^^^^^^^^^^^^^^^^^^^^^^
> The patch adds mutex but the issue is that drop_cached_dir_by_name()
> is holding a spinlock and we can't take a mutex if we're already holding
> a spinlock.
>
> --> 492         }
>     493         spin_unlock(&cfid->fid_lock);
>     494         close_cached_dir(cfid);
>     495 }
>
> regards,
> dan carpenter
>

Hi Dan,

Good catches. I'll fix them both.

-- 
Regards,
Shyam