smb: client: Fix use-after-free in cifs_try_adding_channels()

cifs_try_adding_channels() takes a temporary reference to an interface
before dropping iface_lock. If cifs_ses_add_channel() fails, it drops
that reference and then increments iface->weight_fulfilled.

A concurrent interface list refresh can remove the list reference while
channel creation is in progress. In that case, the failure-path
kref_put() releases the last reference and frees iface. Updating
weight_fulfilled afterward then accesses freed memory.

Increment weight_fulfilled before dropping the temporary reference,
keeping iface alive for the final access.

Fixes: 6aac002bcfd5 ("cifs: failure to add channel on iface should bump up weight")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c
index de2012cc9cf3ede57c80e148530c95b2e394ad70..7cf7dd104f7c31d1a64c747cfa5ba2241105f92e 100644 (file)
--- a/fs/smb/client/sess.c
+++ b/fs/smb/client/sess.c
@@ -233,9 +233,9 @@ int cifs_try_adding_channels(struct cifs_ses *ses)
                                cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
                                         &iface->sockaddr,
                                         rc);
-                               kref_put(&iface->refcount, release_iface);
                                /* failure to add chan should increase weight */
                                iface->weight_fulfilled++;
+                               kref_put(&iface->refcount, release_iface);
                                continue;
                        }