This is a note to let you know that I've just added the patch titled
smb: client: refresh referral without acquiring refpath_lock
to the 6.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
smb-client-refresh-referral-without-acquiring-refpath_lock.patch
and it can be found in the queue-6.8 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 0a05ad21d77a188d06481c36d6016805a881bcc0 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@xxxxxxxxxxxxx>
Date: Mon, 1 Apr 2024 22:44:07 -0300
Subject: smb: client: refresh referral without acquiring refpath_lock
From: Paulo Alcantara <pc@xxxxxxxxxxxxx>
commit 0a05ad21d77a188d06481c36d6016805a881bcc0 upstream.
Avoid refreshing DFS referral with refpath_lock acquired as the I/O
could block for a while due to a potentially disconnected or slow DFS
root server and then making other threads - that use same @server and
don't require a DFS root server - unable to make any progress.
Cc: stable@xxxxxxxxxxxxxxx # 6.4+
Signed-off-by: Paulo Alcantara (Red Hat) <pc@xxxxxxxxxxxxx>
Signed-off-by: Steve French <stfrench@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/smb/client/dfs_cache.c | 44 ++++++++++++++++++++++++--------------------
1 file changed, 24 insertions(+), 20 deletions(-)
--- a/fs/smb/client/dfs_cache.c
+++ b/fs/smb/client/dfs_cache.c
@@ -1172,8 +1172,8 @@ static bool is_ses_good(struct cifs_ses
return ret;
}
-/* Refresh dfs referral of tcon and mark it for reconnect if needed */
-static int __refresh_tcon(const char *path, struct cifs_ses *ses, bool force_refresh)
+/* Refresh dfs referral of @ses and mark it for reconnect if needed */
+static void __refresh_ses_referral(struct cifs_ses *ses, bool force_refresh)
{
struct TCP_Server_Info *server = ses->server;
DFS_CACHE_TGT_LIST(old_tl);
@@ -1181,10 +1181,21 @@ static int __refresh_tcon(const char *pa
bool needs_refresh = false;
struct cache_entry *ce;
unsigned int xid;
+ char *path = NULL;
int rc = 0;
xid = get_xid();
+ mutex_lock(&server->refpath_lock);
+ if (server->leaf_fullpath) {
+ path = kstrdup(server->leaf_fullpath + 1, GFP_ATOMIC);
+ if (!path)
+ rc = -ENOMEM;
+ }
+ mutex_unlock(&server->refpath_lock);
+ if (!path)
+ goto out;
+
down_read(&htable_rw_lock);
ce = lookup_cache_entry(path);
needs_refresh = force_refresh || IS_ERR(ce) || cache_entry_expired(ce);
@@ -1218,19 +1229,17 @@ out:
free_xid(xid);
dfs_cache_free_tgts(&old_tl);
dfs_cache_free_tgts(&new_tl);
- return rc;
+ kfree(path);
}
-static int refresh_tcon(struct cifs_tcon *tcon, bool force_refresh)
+static inline void refresh_ses_referral(struct cifs_ses *ses)
{
- struct TCP_Server_Info *server = tcon->ses->server;
- struct cifs_ses *ses = tcon->ses;
+ __refresh_ses_referral(ses, false);
+}
- mutex_lock(&server->refpath_lock);
- if (server->leaf_fullpath)
- __refresh_tcon(server->leaf_fullpath + 1, ses, force_refresh);
- mutex_unlock(&server->refpath_lock);
- return 0;
+static inline void force_refresh_ses_referral(struct cifs_ses *ses)
+{
+ __refresh_ses_referral(ses, true);
}
/**
@@ -1271,25 +1280,20 @@ int dfs_cache_remount_fs(struct cifs_sb_
*/
cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
- return refresh_tcon(tcon, true);
+ force_refresh_ses_referral(tcon->ses);
+ return 0;
}
/* Refresh all DFS referrals related to DFS tcon */
void dfs_cache_refresh(struct work_struct *work)
{
- struct TCP_Server_Info *server;
struct cifs_tcon *tcon;
struct cifs_ses *ses;
tcon = container_of(work, struct cifs_tcon, dfs_cache_work.work);
- for (ses = tcon->ses; ses; ses = ses->dfs_root_ses) {
- server = ses->server;
- mutex_lock(&server->refpath_lock);
- if (server->leaf_fullpath)
- __refresh_tcon(server->leaf_fullpath + 1, ses, false);
- mutex_unlock(&server->refpath_lock);
- }
+ for (ses = tcon->ses; ses; ses = ses->dfs_root_ses)
+ refresh_ses_referral(ses);
queue_delayed_work(dfscache_wq, &tcon->dfs_cache_work,
atomic_read(&dfs_cache_ttl) * HZ);
Patches currently in stable-queue which might be from pc@xxxxxxxxxxxxx are
queue-6.8/smb-client-fix-potential-uaf-in-cifs_stats_proc_write.patch
queue-6.8/smb-client-fix-potential-uaf-in-is_valid_oplock_break.patch
queue-6.8/smb-client-guarantee-refcounted-children-from-parent-session.patch
queue-6.8/smb-client-serialise-cifs_construct_tcon-with-cifs_mount_mutex.patch
queue-6.8/smb-client-fix-potential-uaf-in-cifs_dump_full_key.patch
queue-6.8/smb-client-refresh-referral-without-acquiring-refpath_lock.patch
queue-6.8/smb-client-fix-potential-uaf-in-smb2_is_network_name_deleted.patch
queue-6.8/smb-client-fix-potential-uaf-in-cifs_debug_files_proc_show.patch
queue-6.8/smb-client-handle-dfs-tcons-in-cifs_construct_tcon.patch
queue-6.8/smb-client-fix-uaf-in-smb2_reconnect_server.patch
queue-6.8/smb-client-fix-potential-uaf-in-smb2_is_valid_lease_break.patch
queue-6.8/smb-client-fix-potential-uaf-in-cifs_signal_cifsd_for_reconnect.patch
queue-6.8/smb-client-fix-potential-uaf-in-cifs_stats_proc_show.patch
queue-6.8/smb-client-fix-potential-uaf-in-smb2_is_valid_oplock_break.patch
