diff options
| author | Paulo Alcantara <pc@manguebit.com> | 2024-04-01 22:37:42 -0500 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2024-04-02 10:09:57 -0500 |
| commit | 062a7f0ff46eb57aff526897bd2bebfdb1d3046a (patch) | |
| tree | a65b2e2e9eb0cd89761ac42b93993765a2f2c23b /fs/smb/client/misc.c | |
| parent | e9e62243a3e2322cf639f653a0b0a88a76446ce7 (diff) | |
| download | linux-stable-062a7f0ff46eb57aff526897bd2bebfdb1d3046a.tar.gz linux-stable-062a7f0ff46eb57aff526897bd2bebfdb1d3046a.tar.bz2 linux-stable-062a7f0ff46eb57aff526897bd2bebfdb1d3046a.zip | |
smb: client: guarantee refcounted children from parent session
Avoid potential use-after-free bugs when walking DFS referrals,
mounting and performing DFS failover by ensuring that all children
from parent @tcon->ses are also refcounted. They're all needed across
the entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at
it, too.
Cc: stable@vger.kernel.org # 6.4+
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202404021527.ZlRkIxgv-lkp@intel.com/
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'fs/smb/client/misc.c')
| -rw-r--r-- | fs/smb/client/misc.c | 6 |
1 files changed, 0 insertions, 6 deletions
diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c index c3771fc81328..1ea22b3955a2 100644 --- a/fs/smb/client/misc.c +++ b/fs/smb/client/misc.c @@ -138,9 +138,6 @@ tcon_info_alloc(bool dir_leases_enabled) atomic_set(&ret_buf->num_local_opens, 0); atomic_set(&ret_buf->num_remote_opens, 0); ret_buf->stats_from_time = ktime_get_real_seconds(); -#ifdef CONFIG_CIFS_DFS_UPCALL - INIT_LIST_HEAD(&ret_buf->dfs_ses_list); -#endif return ret_buf; } @@ -156,9 +153,6 @@ tconInfoFree(struct cifs_tcon *tcon) atomic_dec(&tconInfoAllocCount); kfree(tcon->nativeFileSystem); kfree_sensitive(tcon->password); -#ifdef CONFIG_CIFS_DFS_UPCALL - dfs_put_root_smb_sessions(&tcon->dfs_ses_list); -#endif kfree(tcon->origin_fullpath); kfree(tcon); } |