 cifs: fix potential oops in cifs_oplock_break · gregkh/linux@6b67a6d · GitHub Skip to content Navigation Menu Toggle navigation Sign in Appearance settings Platform AI CODE CREATION GitHub Copilot Write better code with AI GitHub Spark Build and deploy intelligent apps GitHub Models Manage and compare prompts MCP Registry New Integrate external tools DEVELOPER WORKFLOWS Actions Automate any workflow Codespaces Instant dev environments Issues Plan and track work Code Review Manage code changes APPLICATION SECURITY GitHub Advanced Security Find and fix vulnerabilities Code security Secure your code as you build Secret protection  EXPLORE Why GitHub Documentation Blog Changelog Marketplace View all features Solutions BY COMPANY SIZE Enterprises Small and medium teams Startups Nonprofits BY USE CASE App Modernization DevSecOps DevOps CI/CD View all use cases BY INDUSTRY Healthcare Financial services Manufacturing Government View all industries View all solutions Resources EXPLORE BY TOPIC AI Software Development DevOps Security View all topics EXPLORE BY TYPE Customer stories Events &amp; webinars Ebooks &amp; reports Business insights GitHub Skills SUPPORT &amp; SERVICES Documentation Customer support Community forum Trust center Partners View all resources Open Source COMMUNITY GitHub Sponsors Fund open source developers PROGRAMS Security Lab Maintainer Community Accelerator GitHub Stars Archive Program REPOSITORIES Topics Trending Collections Enterprise ENTERPRISE SOLUTIONS Enterprise platform AI-powered developer platform AVAILABLE ADD-ONS GitHub Advanced Security Enterprise-grade security features Copilot for Business Enterprise-grade AI features Premium Support Enterprise-grade 24/7 support Pricing Search or jump to... Search code, repositories, users, issues, pull requests... --> Search Clear Search syntax tips Provide feedback --> We read every piece of feedback, and take your input very seriously.  Cancel Submit feedback Saved searches Use saved searches to filter your results more quickly --> Name Query To see all available qualifiers, see our documentation . Cancel Create saved search Sign in Sign up Appearance settings Resetting focus You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert {{ message }} gregkh / linux Public Notifications You must be signed in to change notification settings Fork 676 Star 636 Code Actions Security and quality 0 Insights Additional navigation options Code Actions Security and quality Insights Commit 6b67a6d Browse files Browse files smfrench authored and gregkh committed cifs: fix potential oops in cifs_oplock_break [ Upstream commit e8f5f84 ] With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send the lease response, oplock_response(), this can mean that an unmount (kill_sb) can occur just before we were checking if the tcon-&gt;ses is valid. See below: [Fri Aug 4 04:12:50 2023] RIP: 0010:cifs_oplock_break+0x1f7/0x5b0 [cifs] [Fri Aug 4 04:12:50 2023] Code: 7d a8 48 8b 7d c0 c0 e9 02 48 89 45 b8 41 89 cf e8 3e f5 ff ff 4c 89 f7 41 83 e7 01 e8 82 b3 03 f2 49 8b 45 50 48 85 c0 74 5e &lt;48&gt; 83 78 60 00 74 57 45 84 ff 75 52 48 8b 43 98 48 83 eb 68 48 39 [Fri Aug 4 04:12:50 2023] RSP: 0018:ffffb30607ddbdf8 EFLAGS: 00010206 [Fri Aug 4 04:12:50 2023] RAX: 632d223d32612022 RBX: ffff97136944b1e0 RCX: 0000000080100009 [Fri Aug 4 04:12:50 2023] RDX: 0000000000000001 RSI: 0000000080100009 RDI: ffff97136944b188 [Fri Aug 4 04:12:50 2023] RBP: ffffb30607ddbe58 R08: 0000000000000001 R09: ffffffffc08e0900 [Fri Aug 4 04:12:50 2023] R10: 0000000000000001 R11: 000000000000000f R12: ffff97136944b138 [Fri Aug 4 04:12:50 2023] R13: ffff97149147c000 R14: ffff97136944b188 R15: 0000000000000000 [Fri Aug 4 04:12:50 2023] FS: 0000000000000000(0000) GS:ffff9714f7c00000(0000) knlGS:0000000000000000 [Fri Aug 4 04:12:50 2023] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [Fri Aug 4 04:12:50 2023] CR2: 00007fd8de9c7590 CR3: 000000011228e000 CR4: 0000000000350ef0 [Fri Aug 4 04:12:50 2023] Call Trace: [Fri Aug 4 04:12:50 2023] &lt;TASK&gt; [Fri Aug 4 04:12:50 2023] process_one_work+0x225/0x3d0 [Fri Aug 4 04:12:50 2023] worker_thread+0x4d/0x3e0 [Fri Aug 4 04:12:50 2023] ? process_one_work+0x3d0/0x3d0 [Fri Aug 4 04:12:50 2023] kthread+0x12a/0x150 [Fri Aug 4 04:12:50 2023] ? set_kthread_struct+0x50/0x50 [Fri Aug 4 04:12:50 2023] ret_from_fork+0x22/0x30 [Fri Aug 4 04:12:50 2023] &lt;/TASK&gt; To fix this change the ordering of the checks before sending the oplock_response to first check if the openFileList is empty. Fixes: da787d5 ("SMB3: Do not send lease break acknowledgment if all file handles have been closed") Suggested-by: Bharath SM &lt;bharathsm@microsoft.com&gt; Reviewed-by: Bharath SM &lt;bharathsm@microsoft.com&gt; Reviewed-by: Shyam Prasad N &lt;sprasad@microsoft.com&gt; Signed-off-by: Paulo Alcantara (SUSE) &lt;pc@manguebit.com&gt; Signed-off-by: Steve French &lt;stfrench@microsoft.com&gt; Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt; 1 parent 8671f8b commit 6b67a6d Copy full SHA for 6b67a6d 1 file changed + 16 - 7 Lines changed: 16 additions &amp; 7 deletions File tree Expand file tree Collapse file tree Open diff view settings Filter options fs/smb/client file.c Expand file tree Collapse file tree Open diff view settings Collapse file ‎ fs/smb/client/file.c ‎ Copy file name to clipboard Expand all lines: fs/smb/client/file.c + 16 - 7 Lines changed: 16 additions &amp; 7 deletions Original file line number Diff line number Diff line change @@ -4878,9 +4878,11 @@ void cifs_oplock_break(struct work_struct *work) 4878 4878 struct cifsFileInfo * cfile = container_of ( work , struct cifsFileInfo , 4879 4879 oplock_break ); 4880 4880 struct inode * inode = d_inode ( cfile -&gt; dentry ); 4881 + struct cifs_sb_info * cifs_sb = CIFS_SB ( inode -&gt; i_sb ); 4881 4882 struct cifsInodeInfo * cinode = CIFS_I ( inode ); 4882 - struct cifs_tcon * tcon = tlink_tcon ( cfile -&gt; tlink ); 4883 - struct TCP_Server_Info * server = tcon -&gt; ses -&gt; server ; 4883 + struct cifs_tcon * tcon ; 4884 + struct TCP_Server_Info * server ; 4885 + struct tcon_link * tlink ; 4884 4886 int rc = 0 ; 4885 4887 bool purge_cache = false, oplock_break_cancelled ; 4886 4888 __u64 persistent_fid , volatile_fid ; @@ -4889,6 +4891,12 @@ void cifs_oplock_break(struct work_struct *work) 4889 4891 wait_on_bit ( &amp; cinode -&gt; flags , CIFS_INODE_PENDING_WRITERS , 4890 4892 TASK_UNINTERRUPTIBLE ); 4891 4893 4894 + tlink = cifs_sb_tlink ( cifs_sb ); 4895 + if ( IS_ERR ( tlink )) 4896 + goto out ; 4897 + tcon = tlink_tcon ( tlink ); 4898 + server = tcon -&gt; ses -&gt; server ; 4899 + 4892 4900 server -&gt; ops -&gt; downgrade_oplock ( server , cinode , cfile -&gt; oplock_level , 4893 4901 cfile -&gt; oplock_epoch , &amp; purge_cache ); 4894 4902 @@ -4938,18 +4946,19 @@ void cifs_oplock_break(struct work_struct *work) 4938 4946 /* 4939 4947 * MS-SMB2 3.2.5.19.1 and 3.2.5.19.2 (and MS-CIFS 3.2.5.42) do not require 4940 4948 * an acknowledgment to be sent when the file has already been closed. 4941 - * check for server null, since can race with kill_sb calling tree disconnect. 4942 4949 */ 4943 4950 spin_lock ( &amp; cinode -&gt; open_file_lock ); 4944 - if ( tcon -&gt; ses &amp;&amp; tcon -&gt; ses -&gt; server &amp;&amp; ! oplock_break_cancelled &amp;&amp; 4945 - ! list_empty ( &amp; cinode -&gt; openFileList )) { 4951 + /* check list empty since can race with kill_sb calling tree disconnect */ 4952 + if (! oplock_break_cancelled &amp;&amp; ! list_empty ( &amp; cinode -&gt; openFileList )) { 4946 4953 spin_unlock ( &amp; cinode -&gt; open_file_lock ); 4947 - rc = tcon -&gt; ses -&gt; server -&gt; ops -&gt; oplock_response ( tcon , persistent_fid , 4948 - volatile_fid , net_fid , cinode ); 4954 + rc = server -&gt; ops -&gt; oplock_response ( tcon , persistent_fid , 4955 + volatile_fid , net_fid , cinode ); 4949 4956 cifs_dbg ( FYI , &quot;Oplock release rc = %d\n&quot; , rc ); 4950 4957 } else 4951 4958 spin_unlock ( &amp; cinode -&gt; open_file_lock ); 4952 4959 4960 + cifs_put_tlink ( tlink ); 4961 + out : 4953 4962 cifs_done_oplock_break ( cinode ); 4954 4963 } 4955 4964 0 commit comments Comments 0 ( 0 ) Footer &copy; 2026 GitHub,&nbsp;Inc. Footer navigation Terms Privacy Security Status Community Docs Contact Manage cookies Do not share my personal information You can’t perform that action at this time. 