]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
CIFS: Fix use after free of file info structures
authorPavel Shilovsky <pshilov@microsoft.com>
Wed, 23 Oct 2019 22:37:19 +0000 (15:37 -0700)
committerBen Hutchings <ben@decadent.org.uk>
Fri, 22 Nov 2019 15:57:31 +0000 (15:57 +0000)
commitbc2152267439591e5d7cfc55a567eb4afb4d08f1
treeb85c89f165ed7c1f36d69fa2e2c23cb5bc6b730c
parent127f62164e57659830141115ea1697496cb5dc8e
CIFS: Fix use after free of file info structures

commit 1a67c415965752879e2e9fad407bc44fc7f25f23 upstream.

Currently the code assumes that if a file info entry belongs
to lists of open file handles of an inode and a tcon then
it has non-zero reference. The recent changes broke that
assumption when putting the last reference of the file info.
There may be a situation when a file is being deleted but
nothing prevents another thread to reference it again
and start using it. This happens because we do not hold
the inode list lock while checking the number of references
of the file info structure. Fix this by doing the proper
locking when doing the check.

Fixes: 487317c99477d ("cifs: add spinlock for the openFileList to cifsInodeInfo")
Fixes: cb248819d209d ("cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic")
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
fs/cifs/file.c