diff options
| author | Xiaomeng Tong <xiam0nd.tong@gmail.com> | 2022-03-20 16:50:15 +0300 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2022-03-23 23:20:15 +0300 |
| commit | a96c94481f5993eac2271f9fb4d009b7dc076c24 (patch) | |
| tree | 501b2964ccd2d7878d6a2b6b3e7c0b08fa1c2e63 | |
| parent | 2d004c6cae567e33ab2e197757181c72a322451f (diff) | |
| download | linux-a96c94481f5993eac2271f9fb4d009b7dc076c24.tar.xz | |
cifs: fix incorrect use of list iterator after the loop
The bug is here:
if (!tcon) {
resched = true;
list_del_init(&ses->rlist);
cifs_put_smb_ses(ses);
Because the list_for_each_entry() never exits early (without any
break/goto/return inside the loop), the iterator 'ses' after the
loop will always be an pointer to a invalid struct containing the
HEAD (&pserver->smb_ses_list). As a result, the uses of 'ses' above
will lead to a invalid memory access.
The original intention should have been to walk each entry 'ses' in
'&tmp_ses_list', delete '&ses->rlist' and put 'ses'. So fix it with
a list_for_each_entry_safe().
Cc: stable@vger.kernel.org # 5.17
Fixes: 3663c9045f51a ("cifs: check reconnects for channels of active tcons too")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
| -rw-r--r-- | fs/cifs/smb2pdu.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 7e15b0092243..54b554c7aee8 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -3853,8 +3853,10 @@ void smb2_reconnect_server(struct work_struct *work) tcon = kzalloc(sizeof(struct cifs_tcon), GFP_KERNEL); if (!tcon) { resched = true; - list_del_init(&ses->rlist); - cifs_put_smb_ses(ses); + list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { + list_del_init(&ses->rlist); + cifs_put_smb_ses(ses); + } goto done; } |