Skip to content

Commit 5ee28bc

Browse files
smfrenchgregkh
smfrench
authored and
gregkh
committed
cifs: fix potential oops in cifs_oplock_break
[ Upstream commit e8f5f84 ] With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send the lease response, oplock_response(), this can mean that an unmount (kill_sb) can occur just before we were checking if the tcon->ses is valid. See below: [Fri Aug 4 04:12:50 2023] RIP: 0010:cifs_oplock_break+0x1f7/0x5b0 [cifs] [Fri Aug 4 04:12:50 2023] Code: 7d a8 48 8b 7d c0 c0 e9 02 48 89 45 b8 41 89 cf e8 3e f5 ff ff 4c 89 f7 41 83 e7 01 e8 82 b3 03 f2 49 8b 45 50 48 85 c0 74 5e <48> 83 78 60 00 74 57 45 84 ff 75 52 48 8b 43 98 48 83 eb 68 48 39 [Fri Aug 4 04:12:50 2023] RSP: 0018:ffffb30607ddbdf8 EFLAGS: 00010206 [Fri Aug 4 04:12:50 2023] RAX: 632d223d32612022 RBX: ffff97136944b1e0 RCX: 0000000080100009 [Fri Aug 4 04:12:50 2023] RDX: 0000000000000001 RSI: 0000000080100009 RDI: ffff97136944b188 [Fri Aug 4 04:12:50 2023] RBP: ffffb30607ddbe58 R08: 0000000000000001 R09: ffffffffc08e0900 [Fri Aug 4 04:12:50 2023] R10: 0000000000000001 R11: 000000000000000f R12: ffff97136944b138 [Fri Aug 4 04:12:50 2023] R13: ffff97149147c000 R14: ffff97136944b188 R15: 0000000000000000 [Fri Aug 4 04:12:50 2023] FS: 0000000000000000(0000) GS:ffff9714f7c00000(0000) knlGS:0000000000000000 [Fri Aug 4 04:12:50 2023] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [Fri Aug 4 04:12:50 2023] CR2: 00007fd8de9c7590 CR3: 000000011228e000 CR4: 0000000000350ef0 [Fri Aug 4 04:12:50 2023] Call Trace: [Fri Aug 4 04:12:50 2023] <TASK> [Fri Aug 4 04:12:50 2023] process_one_work+0x225/0x3d0 [Fri Aug 4 04:12:50 2023] worker_thread+0x4d/0x3e0 [Fri Aug 4 04:12:50 2023] ? process_one_work+0x3d0/0x3d0 [Fri Aug 4 04:12:50 2023] kthread+0x12a/0x150 [Fri Aug 4 04:12:50 2023] ? set_kthread_struct+0x50/0x50 [Fri Aug 4 04:12:50 2023] ret_from_fork+0x22/0x30 [Fri Aug 4 04:12:50 2023] </TASK> To fix this change the ordering of the checks before sending the oplock_response to first check if the openFileList is empty. Fixes: da787d5 ("SMB3: Do not send lease break acknowledgment if all file handles have been closed") Suggested-by: Bharath SM <bharathsm@microsoft.com> Reviewed-by: Bharath SM <bharathsm@microsoft.com> Reviewed-by: Shyam Prasad N <sprasad@microsoft.com> Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
1 parent cba26ab commit 5ee28bc

1 file changed

Lines changed: 16 additions & 7 deletions

File tree

‎fs/smb/client/file.c‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5082,9 +5082,11 @@ void cifs_oplock_break(struct work_struct *work)
50825082
struct cifsFileInfo *cfile = container_of(work, struct cifsFileInfo,
50835083
oplock_break);
50845084
struct inode *inode = d_inode(cfile->dentry);
5085+
struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
50855086
struct cifsInodeInfo *cinode = CIFS_I(inode);
5086-
struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
5087-
struct TCP_Server_Info *server = tcon->ses->server;
5087+
struct cifs_tcon *tcon;
5088+
struct TCP_Server_Info *server;
5089+
struct tcon_link *tlink;
50885090
int rc = 0;
50895091
bool purge_cache = false, oplock_break_cancelled;
50905092
__u64 persistent_fid, volatile_fid;
@@ -5093,6 +5095,12 @@ void cifs_oplock_break(struct work_struct *work)
50935095
wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS,
50945096
TASK_UNINTERRUPTIBLE);
50955097

5098+
tlink = cifs_sb_tlink(cifs_sb);
5099+
if (IS_ERR(tlink))
5100+
goto out;
5101+
tcon = tlink_tcon(tlink);
5102+
server = tcon->ses->server;
5103+
50965104
server->ops->downgrade_oplock(server, cinode, cfile->oplock_level,
50975105
cfile->oplock_epoch, &purge_cache);
50985106

@@ -5142,18 +5150,19 @@ void cifs_oplock_break(struct work_struct *work)
51425150
/*
51435151
* MS-SMB2 3.2.5.19.1 and 3.2.5.19.2 (and MS-CIFS 3.2.5.42) do not require
51445152
* an acknowledgment to be sent when the file has already been closed.
5145-
* check for server null, since can race with kill_sb calling tree disconnect.
51465153
*/
51475154
spin_lock(&cinode->open_file_lock);
5148-
if (tcon->ses && tcon->ses->server && !oplock_break_cancelled &&
5149-
!list_empty(&cinode->openFileList)) {
5155+
/* check list empty since can race with kill_sb calling tree disconnect */
5156+
if (!oplock_break_cancelled && !list_empty(&cinode->openFileList)) {
51505157
spin_unlock(&cinode->open_file_lock);
5151-
rc = tcon->ses->server->ops->oplock_response(tcon, persistent_fid,
5152-
volatile_fid, net_fid, cinode);
5158+
rc = server->ops->oplock_response(tcon, persistent_fid,
5159+
volatile_fid, net_fid, cinode);
51535160
cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
51545161
} else
51555162
spin_unlock(&cinode->open_file_lock);
51565163

5164+
cifs_put_tlink(tlink);
5165+
out:
51575166
cifs_done_oplock_break(cinode);
51585167
}
51595168

0 commit comments

Comments
 (0)