From ff7d80a9f2711bf3d9fe1cfb70b3fd15c50584b7 Mon Sep 17 00:00:00 2001 From: Winston Wen Date: Mon, 26 Jun 2023 11:42:55 +0800 Subject: cifs: fix session state transition to avoid use-after-free issue We switch session state to SES_EXITING without cifs_tcp_ses_lock now, it may lead to potential use-after-free issue. Consider the following execution processes: Thread 1: __cifs_put_smb_ses() spin_lock(&cifs_tcp_ses_lock) if (--ses->ses_count > 0) spin_unlock(&cifs_tcp_ses_lock) return spin_unlock(&cifs_tcp_ses_lock) ---> **GAP** spin_lock(&ses->ses_lock) if (ses->ses_status == SES_GOOD) ses->ses_status = SES_EXITING spin_unlock(&ses->ses_lock) Thread 2: cifs_find_smb_ses() spin_lock(&cifs_tcp_ses_lock) list_for_each_entry(ses, ...) spin_lock(&ses->ses_lock) if (ses->ses_status == SES_EXITING) spin_unlock(&ses->ses_lock) continue ... spin_unlock(&ses->ses_lock) if (ret) cifs_smb_ses_inc_refcount(ret) spin_unlock(&cifs_tcp_ses_lock) If thread 1 is preempted in the gap and thread 2 start executing, thread 2 will get the session, and soon thread 1 will switch the session state to SES_EXITING and start releasing it, even though thread 1 had increased the session's refcount and still uses it. So switch session state under cifs_tcp_ses_lock to eliminate this gap. Signed-off-by: Winston Wen Signed-off-by: Steve French --- fs/smb/client/connect.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'fs/smb') diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c index dab7bc876507..85dd1b373974 100644 --- a/fs/smb/client/connect.c +++ b/fs/smb/client/connect.c @@ -1967,15 +1967,16 @@ void __cifs_put_smb_ses(struct cifs_ses *ses) spin_unlock(&cifs_tcp_ses_lock); return; } + spin_lock(&ses->ses_lock); + if (ses->ses_status == SES_GOOD) + ses->ses_status = SES_EXITING; + spin_unlock(&ses->ses_lock); spin_unlock(&cifs_tcp_ses_lock); /* ses_count can never go negative */ WARN_ON(ses->ses_count < 0); spin_lock(&ses->ses_lock); - if (ses->ses_status == SES_GOOD) - ses->ses_status = SES_EXITING; - if (ses->ses_status == SES_EXITING && server->ops->logoff) { spin_unlock(&ses->ses_lock); cifs_free_ipc(ses); -- cgit v1.2.3 From dfbf0ee092a5d7a9301c81e815b5e50b7c0aeeda Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Fri, 30 Jun 2023 12:33:37 +0100 Subject: smb: client: remove redundant pointer 'server' The pointer 'server' is assigned but never read, the pointer is redundant and can be removed. Cleans up clang scan build warning: fs/smb/client/dfs.c:217:3: warning: Value stored to 'server' is never read [deadcode.DeadStores] Signed-off-by: Colin Ian King Signed-off-by: Steve French --- fs/smb/client/dfs.c | 2 -- 1 file changed, 2 deletions(-) (limited to 'fs/smb') diff --git a/fs/smb/client/dfs.c b/fs/smb/client/dfs.c index 26d14dd0482e..1403a2d1ab17 100644 --- a/fs/smb/client/dfs.c +++ b/fs/smb/client/dfs.c @@ -143,7 +143,6 @@ static int __dfs_mount_share(struct cifs_mount_ctx *mnt_ctx) struct smb3_fs_context *ctx = mnt_ctx->fs_ctx; char *ref_path = NULL, *full_path = NULL; struct dfs_cache_tgt_iterator *tit; - struct TCP_Server_Info *server; struct cifs_tcon *tcon; char *origin_fullpath = NULL; char sep = CIFS_DIR_SEP(cifs_sb); @@ -214,7 +213,6 @@ static int __dfs_mount_share(struct cifs_mount_ctx *mnt_ctx) } while (rc == -EREMOTE); if (!rc) { - server = mnt_ctx->server; tcon = mnt_ctx->tcon; spin_lock(&tcon->tc_lock); -- cgit v1.2.3 From d14de8067e3f9653cdef5a094176d00f3260ab20 Mon Sep 17 00:00:00 2001 From: Ronnie Sahlberg Date: Thu, 6 Jul 2023 12:32:24 +1000 Subject: cifs: Add a laundromat thread for cached directories and drop cached directories after 30 seconds Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French --- fs/smb/client/cached_dir.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++ fs/smb/client/cached_dir.h | 1 + 2 files changed, 68 insertions(+) (limited to 'fs/smb') diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c index bfc964b36c72..fe483f163dbc 100644 --- a/fs/smb/client/cached_dir.c +++ b/fs/smb/client/cached_dir.c @@ -568,6 +568,53 @@ static void free_cached_dir(struct cached_fid *cfid) kfree(cfid); } +static int +cifs_cfids_laundromat_thread(void *p) +{ + struct cached_fids *cfids = p; + struct cached_fid *cfid, *q; + struct list_head entry; + + while (!kthread_should_stop()) { + ssleep(1); + INIT_LIST_HEAD(&entry); + if (kthread_should_stop()) + return 0; + spin_lock(&cfids->cfid_list_lock); + list_for_each_entry_safe(cfid, q, &cfids->entries, entry) { + if (time_after(jiffies, cfid->time + HZ * 30)) { + list_del(&cfid->entry); + list_add(&cfid->entry, &entry); + cfids->num_entries--; + } + } + spin_unlock(&cfids->cfid_list_lock); + + list_for_each_entry_safe(cfid, q, &entry, entry) { + cfid->on_list = false; + list_del(&cfid->entry); + /* + * Cancel, and wait for the work to finish in + * case we are racing with it. + */ + cancel_work_sync(&cfid->lease_break); + if (cfid->has_lease) { + /* + * We lease has not yet been cancelled from + * the server so we need to drop the reference. + */ + spin_lock(&cfids->cfid_list_lock); + cfid->has_lease = false; + spin_unlock(&cfids->cfid_list_lock); + kref_put(&cfid->refcount, smb2_close_cached_fid); + } + } + } + + return 0; +} + + struct cached_fids *init_cached_dirs(void) { struct cached_fids *cfids; @@ -577,6 +624,20 @@ struct cached_fids *init_cached_dirs(void) return NULL; spin_lock_init(&cfids->cfid_list_lock); INIT_LIST_HEAD(&cfids->entries); + + /* + * since we're in a cifs function already, we know that + * this will succeed. No need for try_module_get(). + */ + __module_get(THIS_MODULE); + cfids->laundromat = kthread_run(cifs_cfids_laundromat_thread, + cfids, "cifsd-cfid-laundromat"); + if (IS_ERR(cfids->laundromat)) { + cifs_dbg(VFS, "Failed to start cfids laundromat thread.\n"); + kfree(cfids); + module_put(THIS_MODULE); + return NULL; + } return cfids; } @@ -589,6 +650,12 @@ void free_cached_dirs(struct cached_fids *cfids) struct cached_fid *cfid, *q; LIST_HEAD(entry); + if (cfids->laundromat) { + kthread_stop(cfids->laundromat); + cfids->laundromat = NULL; + module_put(THIS_MODULE); + } + spin_lock(&cfids->cfid_list_lock); list_for_each_entry_safe(cfid, q, &cfids->entries, entry) { cfid->on_list = false; diff --git a/fs/smb/client/cached_dir.h b/fs/smb/client/cached_dir.h index 2f4e764c9ca9..facc9b154d00 100644 --- a/fs/smb/client/cached_dir.h +++ b/fs/smb/client/cached_dir.h @@ -57,6 +57,7 @@ struct cached_fids { spinlock_t cfid_list_lock; int num_entries; struct list_head entries; + struct task_struct *laundromat; }; extern struct cached_fids *init_cached_dirs(void); -- cgit v1.2.3