merged into cifs-2.6.git for-next pending review and testing
On Tue, Jan 14, 2025 at 9:48 AM Paulo Alcantara <pc@xxxxxxxxxxxxx> wrote:
>
> When shutting down the server in cifs_put_tcp_session(), cifsd thread
> might be reconnecting to multiple DFS targets before it realizes it
> should exit the loop, so we can't free @server->hostname as long as
> cifsd tread is done. Otherwise the following can happen:
>
> RIP: 0010:__slab_free+0x223/0x3c0
> Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89
> 1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f>
> 0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80
> RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246
> RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068
> RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400
> RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000
> R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500
> R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068
> FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000)
> 000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4:
> PKRU: 55555554
> Call Trace:
> <TASK>
> ? show_trace_log_lvl+0x1c4/0x2df
> ? show_trace_log_lvl+0x1c4/0x2df
> ? __reconnect_target_unlocked+0x3e/0x160 [cifs]
> ? __die_body.cold+0x8/0xd
> ? die+0x2b/0x50
> ? do_trap+0xce/0x120
> ? __slab_free+0x223/0x3c0
> ? do_error_trap+0x65/0x80
> ? __slab_free+0x223/0x3c0
> ? exc_invalid_op+0x4e/0x70
> ? __slab_free+0x223/0x3c0
> ? asm_exc_invalid_op+0x16/0x20
> ? __slab_free+0x223/0x3c0
> ? extract_hostname+0x5c/0xa0 [cifs]
> ? extract_hostname+0x5c/0xa0 [cifs]
> ? __kmalloc+0x4b/0x140
> __reconnect_target_unlocked+0x3e/0x160 [cifs]
> reconnect_dfs_server+0x145/0x430 [cifs]
> cifs_handle_standard+0x1ad/0x1d0 [cifs]
> cifs_demultiplex_thread+0x592/0x730 [cifs]
> ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
> kthread+0xdd/0x100
> ? __pfx_kthread+0x10/0x10
> ret_from_fork+0x29/0x50
> </TASK>
>
> Fixes: 7be3248f3139 ("cifs: To match file servers, make sure the server hostname matches")
> Reported-by: Jay Shin <jaeshin@xxxxxxxxxx>
> Signed-off-by: Paulo Alcantara (Red Hat) <pc@xxxxxxxxxxxxx>
> ---
> fs/smb/client/connect.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
> index ddcc9e514a0e..eaa6be4456d0 100644
> --- a/fs/smb/client/connect.c
> +++ b/fs/smb/client/connect.c
> @@ -1044,6 +1044,7 @@ clean_demultiplex_info(struct TCP_Server_Info *server)
> /* Release netns reference for this server. */
> put_net(cifs_net_ns(server));
> kfree(server->leaf_fullpath);
> + kfree(server->hostname);
> kfree(server);
>
> length = atomic_dec_return(&tcpSesAllocCount);
> @@ -1670,8 +1671,6 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
> kfree_sensitive(server->session_key.response);
> server->session_key.response = NULL;
> server->session_key.len = 0;
> - kfree(server->hostname);
> - server->hostname = NULL;
>
> task = xchg(&server->tsk, NULL);
> if (task)
> --
> 2.47.1
>
--
Thanks,
Steve
