summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorXiaomeng Tong <xiam0nd.tong@gmail.com>2022-03-20 16:50:15 +0300
committerSteve French <stfrench@microsoft.com>2022-03-23 23:20:15 +0300
commita96c94481f5993eac2271f9fb4d009b7dc076c24 (patch)
tree501b2964ccd2d7878d6a2b6b3e7c0b08fa1c2e63 /fs
parent2d004c6cae567e33ab2e197757181c72a322451f (diff)
downloadlinux-a96c94481f5993eac2271f9fb4d009b7dc076c24.tar.xz
cifs: fix incorrect use of list iterator after the loop
The bug is here: if (!tcon) { resched = true; list_del_init(&ses->rlist); cifs_put_smb_ses(ses); Because the list_for_each_entry() never exits early (without any break/goto/return inside the loop), the iterator 'ses' after the loop will always be an pointer to a invalid struct containing the HEAD (&pserver->smb_ses_list). As a result, the uses of 'ses' above will lead to a invalid memory access. The original intention should have been to walk each entry 'ses' in '&tmp_ses_list', delete '&ses->rlist' and put 'ses'. So fix it with a list_for_each_entry_safe(). Cc: stable@vger.kernel.org # 5.17 Fixes: 3663c9045f51a ("cifs: check reconnects for channels of active tcons too") Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com> Reviewed-by: Shyam Prasad N <sprasad@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs')
-rw-r--r--fs/cifs/smb2pdu.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 7e15b0092243..54b554c7aee8 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -3853,8 +3853,10 @@ void smb2_reconnect_server(struct work_struct *work)
tcon = kzalloc(sizeof(struct cifs_tcon), GFP_KERNEL);
if (!tcon) {
resched = true;
- list_del_init(&ses->rlist);
- cifs_put_smb_ses(ses);
+ list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) {
+ list_del_init(&ses->rlist);
+ cifs_put_smb_ses(ses);
+ }
goto done;
}