]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
smb: client: fix races in cifsd thread creation
authorFredric Cover <fredric.cover.lkernel@gmail.com>
Tue, 2 Jun 2026 00:55:10 +0000 (17:55 -0700)
committerSteve French <stfrench@microsoft.com>
Sun, 14 Jun 2026 20:12:23 +0000 (15:12 -0500)
commite8a5cf2ff5a13fefb228f2069e29dd7d8e37185d
treeba362338c817f75f86d3bede80a3077c7e0eb94f
parent29f1005b8b4d3d3d8ac116d85f864a0b83bcf394
smb: client: fix races in cifsd thread creation

The cifsd demultiplex thread can run and access tcp_ses before the parent
thread has finished populating tcp_ses, which the worker thread accesses
locklessly.

Also, the kthread_run macro may start the thread before returning the
thread pointer. Because the pointer is part of the structure that the
thread can access, if the kernel is preempted after the thread is spawned,
but before the thread pointer is populated and the thread attempts to exit,
it will sleep, waiting for a SIGKILL signal.

Fix this by moving creation of the thread to after all of tcp_ses'es
fields are populated, and spawning the thread last, using a split
kthread_create/wake_up_process logic.

Signed-off-by: Fredric Cover <fredric.cover.lkernel@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/client/connect.c