diff options
| author | Paulo Alcantara <pc@manguebit.com> | 2024-04-01 22:37:42 -0500 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2024-04-02 10:09:57 -0500 |
| commit | 062a7f0ff46eb57aff526897bd2bebfdb1d3046a (patch) | |
| tree | a65b2e2e9eb0cd89761ac42b93993765a2f2c23b /fs/smb/client/dfs_cache.c | |
| parent | e9e62243a3e2322cf639f653a0b0a88a76446ce7 (diff) | |
| download | lwn-062a7f0ff46eb57aff526897bd2bebfdb1d3046a.tar.gz lwn-062a7f0ff46eb57aff526897bd2bebfdb1d3046a.zip | |
smb: client: guarantee refcounted children from parent session
Avoid potential use-after-free bugs when walking DFS referrals,
mounting and performing DFS failover by ensuring that all children
from parent @tcon->ses are also refcounted. They're all needed across
the entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at
it, too.
Cc: stable@vger.kernel.org # 6.4+
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202404021527.ZlRkIxgv-lkp@intel.com/
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/smb/client/dfs_cache.c')
| -rw-r--r-- | fs/smb/client/dfs_cache.c | 11 |
1 files changed, 1 insertions, 10 deletions
diff --git a/fs/smb/client/dfs_cache.c b/fs/smb/client/dfs_cache.c index 508d831fabe3..0552a864ff08 100644 --- a/fs/smb/client/dfs_cache.c +++ b/fs/smb/client/dfs_cache.c @@ -1278,21 +1278,12 @@ int dfs_cache_remount_fs(struct cifs_sb_info *cifs_sb) void dfs_cache_refresh(struct work_struct *work) { struct TCP_Server_Info *server; - struct dfs_root_ses *rses; struct cifs_tcon *tcon; struct cifs_ses *ses; tcon = container_of(work, struct cifs_tcon, dfs_cache_work.work); - ses = tcon->ses; - server = ses->server; - mutex_lock(&server->refpath_lock); - if (server->leaf_fullpath) - __refresh_tcon(server->leaf_fullpath + 1, ses, false); - mutex_unlock(&server->refpath_lock); - - list_for_each_entry(rses, &tcon->dfs_ses_list, list) { - ses = rses->ses; + for (ses = tcon->ses; ses; ses = ses->dfs_root_ses) { server = ses->server; mutex_lock(&server->refpath_lock); if (server->leaf_fullpath) |