added Ronnie's reviewed-by to the two patches and put in cifs-2.6.git for-next On Sat, Nov 28, 2020 at 1:54 PM Paulo Alcantara <pc@xxxxxx> wrote: > > This patch fixes a potential use-after-free bug in > cifs_echo_request(). > > For instance, > > thread 1 > -------- > cifs_demultiplex_thread() > clean_demultiplex_info() > kfree(server) > > thread 2 (workqueue) > -------- > apic_timer_interrupt() > smp_apic_timer_interrupt() > irq_exit() > __do_softirq() > run_timer_softirq() > call_timer_fn() > cifs_echo_request() <- use-after-free in server ptr > > Signed-off-by: Paulo Alcantara (SUSE) <pc@xxxxxx> > --- > fs/cifs/connect.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c > index c38156f324dd..28c1459fb0fc 100644 > --- a/fs/cifs/connect.c > +++ b/fs/cifs/connect.c > @@ -876,6 +876,8 @@ static void clean_demultiplex_info(struct TCP_Server_Info *server) > list_del_init(&server->tcp_ses_list); > spin_unlock(&cifs_tcp_ses_lock); > > + cancel_delayed_work_sync(&server->echo); > + > spin_lock(&GlobalMid_Lock); > server->tcpStatus = CifsExiting; > spin_unlock(&GlobalMid_Lock); > -- > 2.29.2 > -- Thanks, Steve
