queue-4.19/cifs-fix-panic-in-smb2_reconnect.patch

   1 From 0ff2b018b02f89da26a616e0148582321a00fd99 Mon Sep 17 00:00:00 2001
   2 From: Ronnie Sahlberg <lsahlber@redhat.com>
   3 Date: Wed, 5 Jun 2019 10:15:34 +1000
   4 Subject: cifs: fix panic in smb2_reconnect
   5
   6 From: Ronnie Sahlberg <lsahlber@redhat.com>
   7
   8 commit 0ff2b018b02f89da26a616e0148582321a00fd99 upstream.
   9
  10 RH Bugzilla: 1702264
  11
  12 We need to protect so that the call to smb2_reconnect() in
  13 smb2_reconnect_server() does not end up freeing the session
  14 because it can lead to a use after free and crash.
  15
  16 Reviewed-by: Aurelien Aptel <aaptel@suse.com>
  17 Cc: <stable@vger.kernel.org>
  18 Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
  19 Signed-off-by: Steve French <stfrench@microsoft.com>
  20 Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22
  23 ---
  24  fs/cifs/smb2pdu.c |   10 +++++++++-
  25  1 file changed, 9 insertions(+), 1 deletion(-)
  26
  27 --- a/fs/cifs/smb2pdu.c
  28 +++ b/fs/cifs/smb2pdu.c
  29 @@ -2869,9 +2869,14 @@ void smb2_reconnect_server(struct work_s
  30                                 tcon_exist = true;
  31                         }
  32                 }
  33 +               /*
  34 +                * IPC has the same lifetime as its session and uses its
  35 +                * refcount.
  36 +                */
  37                 if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) {
  38                         list_add_tail(&ses->tcon_ipc->rlist, &tmp_list);
  39                         tcon_exist = true;
  40 +                       ses->ses_count++;
  41                 }
  42         }
  43         /*
  44 @@ -2890,7 +2895,10 @@ void smb2_reconnect_server(struct work_s
  45                 else
  46                         resched = true;
  47                 list_del_init(&tcon->rlist);
  48 -               cifs_put_tcon(tcon);
  49 +               if (tcon->ipc)
  50 +                       cifs_put_smb_ses(tcon->ses);
  51 +               else
  52 +                       cifs_put_tcon(tcon);
  53         }
  54
  55         cifs_dbg(FYI, "Reconnecting tcons finished\n");