Commit a8d5c15e authored by Paul Aurich's avatar Paul Aurich Committed by Yongjian Sun
Browse files

smb: Initialize cfid->tcon before performing network ops 

mainline inclusion
from mainline-v6.12-rc3
commit c353ee4fb119a2582d0e011f66a76a38f5cf984d
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGF9
CVE: CVE-2024-56729

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c353ee4fb119a2582d0e011f66a76a38f5cf984d



--------------------------------

Avoid leaking a tcon ref when a lease break races with opening the
cached directory. Processing the leak break might take a reference to
the tcon in cached_dir_lease_break() and then fail to release the ref in
cached_dir_offload_close, since cfid->tcon is still NULL.

Fixes: ebe98f14 ("cifs: enable caching of directories for which a lease is held")
Signed-off-by: default avatarPaul Aurich <paul@darkrain42.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
Signed-off-by: default avatarSun Yongjian <sunyongjian1@huawei.com>
parent 604e996d

fs/smb/client/cached_dir.c

+1 −1
Original line number Diff line number Diff line
@@ -212,6 +212,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, 
		}

	}

	cfid->dentry = dentry;

	cfid->tcon = tcon;



	/*

	 * We do not hold the lock for the open because in case
@@ -292,7 +293,6 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, 
		}

		goto oshr_free;

	}

	cfid->tcon = tcon;

	cfid->is_open = true;



	spin_lock(&cfids->cfid_list_lock);