From: Paulo Alcantara Date: Mon, 30 Oct 2023 20:19:53 +0000 (-0300) Subject: smb: client: remove extra @chan_count check in __cifs_put_smb_ses() X-Git-Tag: v6.6.29~157 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fe1bad73d35f228aba3f41538aec401a03add9b1;p=thirdparty%2Fkernel%2Fstable.git smb: client: remove extra @chan_count check in __cifs_put_smb_ses() [ Upstream commit c37ed2d7d09869f30d291b9c6cba56ea4f0b0417 ] If @ses->chan_count <= 1, then for-loop body will not be executed so no need to check it twice. Reviewed-by: Shyam Prasad N Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French Stable-dep-of: 24a9799aa8ef ("smb: client: fix UAF in smb2_reconnect_server()") Signed-off-by: Sasha Levin --- diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c index 97776dd12b6b8..556f3c31aedc7 100644 --- a/fs/smb/client/connect.c +++ b/fs/smb/client/connect.c @@ -2015,9 +2015,10 @@ cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx) void __cifs_put_smb_ses(struct cifs_ses *ses) { - unsigned int rc, xid; - unsigned int chan_count; struct TCP_Server_Info *server = ses->server; + unsigned int xid; + size_t i; + int rc; spin_lock(&ses->ses_lock); if (ses->ses_status == SES_EXITING) { @@ -2063,20 +2064,14 @@ void __cifs_put_smb_ses(struct cifs_ses *ses) list_del_init(&ses->smb_ses_list); spin_unlock(&cifs_tcp_ses_lock); - chan_count = ses->chan_count; - /* close any extra channels */ - if (chan_count > 1) { - int i; - - for (i = 1; i < chan_count; i++) { - if (ses->chans[i].iface) { - kref_put(&ses->chans[i].iface->refcount, release_iface); - ses->chans[i].iface = NULL; - } - cifs_put_tcp_session(ses->chans[i].server, 0); - ses->chans[i].server = NULL; + for (i = 1; i < ses->chan_count; i++) { + if (ses->chans[i].iface) { + kref_put(&ses->chans[i].iface->refcount, release_iface); + ses->chans[i].iface = NULL; } + cifs_put_tcp_session(ses->chans[i].server, 0); + ses->chans[i].server = NULL; } /* we now account for primary channel in iface->refcount */