]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
smb: client: fix incomplete backport in cfids_invalidation_worker()
authorHenrique Carvalho <henrique.carvalho@suse.com>
Wed, 26 Nov 2025 13:55:53 +0000 (10:55 -0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 1 Dec 2025 10:46:06 +0000 (11:46 +0100)
The previous commit bdb596ceb4b7 ("smb: client: fix potential UAF in
smb2_close_cached_fid()") was an incomplete backport and missed one
kref_put() call in cfids_invalidation_worker() that should have been
converted to close_cached_dir().

Fixes: bdb596ceb4b7 ("smb: client: fix potential UAF in smb2_close_cached_fid()")"
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/smb/client/cached_dir.c

index 9c6cf3df5c79fb97ea4efffd0e59f0e3772564a3..a2336fc4f49ee88deda1f7e1bd5215256a623e8e 100644 (file)
@@ -755,7 +755,7 @@ static void cfids_invalidation_worker(struct work_struct *work)
        list_for_each_entry_safe(cfid, q, &entry, entry) {
                list_del(&cfid->entry);
                /* Drop the ref-count acquired in invalidate_all_cached_dirs */
-               kref_put(&cfid->refcount, smb2_close_cached_fid);
+               close_cached_dir(cfid);
        }
 }