]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
smb: server: let recv_done() avoid touching data_transfer after cleanup/move
authorStefan Metzmacher <metze@samba.org>
Mon, 4 Aug 2025 12:15:53 +0000 (14:15 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 15 Aug 2025 10:05:11 +0000 (12:05 +0200)
commit4180eff7d22765b28bfc282bff2a320684693000
treea53c388fbabebfc7e435e63b0ad6a816e97e5762
parente9e2e7459a7278833b085f3d9dbf3c946c0ab6f0
smb: server: let recv_done() avoid touching data_transfer after cleanup/move

[ Upstream commit a6c015b7ac2d8c5233337e5793f50d04fac17669 ]

Calling enqueue_reassembly() and wake_up_interruptible(&t->wait_reassembly_queue)
or put_receive_buffer() means the recvmsg/data_transfer pointer might
get re-used by another thread, which means these should be
the last operations before calling return.

Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/smb/server/transport_rdma.c