[PATCH] smb: client: fix cifsFileInfo reference leak in deferred close

[PATCH] smb: client: fix cifsFileInfo reference leak in deferred close

[Fan Wu]

When cifs_close() defers a close, it hands the cifsFileInfo reference
of the closing struct file to the queued work. Each execution of
smb2_deferred_work_close() drops one such reference.

deferred_close_scheduled can be false while the work is pending: the
workqueue clears PENDING when the callback starts to run, before the
callback clears the flag under deferred_lock. A close in that
interval requeues the running work, and the callback then clears the
flag, leaving the requeued work pending with the flag down. A later
cifs_open() can reuse the handle and its cifs_close() reaches the
same branch: queue_delayed_work() fails because the work is still
pending, but cifs_close() returns without dropping the closing file's
reference. The cifsFileInfo count stays pinned and its tlink, dentry
and server handle are leaked.

Check the return value and hand off the reference only when work was
actually queued. Otherwise, use the shared _cifsFileInfo_put(), like
the mod_delayed_work() branch above: the pending execution already
owns its reference.

This issue was found by an in-house static analysis tool.

Fixes: c3f207ab29f7 ("cifs: Deferred close for files")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 fs/smb/client/file.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c
index ac89c1ba56b1..acb6ac1bbddc 100644
--- a/fs/smb/client/file.c
+++ b/fs/smb/client/file.c
@@ -1490,11 +1490,18 @@ int cifs_close(struct inode *inode, struct file *file)
 				trace_smb3_close_cached(tcon->tid, tcon->ses->Suid,
 						cfile->fid.persistent_fid,
 						cifs_sb->ctx->closetimeo);
-				queue_delayed_work(deferredclose_wq,
-						&cfile->deferred, cifs_sb->ctx->closetimeo);
-				cfile->deferred_close_scheduled = true;
-				spin_unlock(&cinode->deferred_lock);
-				return 0;
+				/*
+				 * Each queued execution owns one reference.
+				 * If nothing was queued, the reference of
+				 * the closing file is dropped below.
+				 */
+				if (queue_delayed_work(deferredclose_wq,
+						       &cfile->deferred,
+						       cifs_sb->ctx->closetimeo)) {
+					cfile->deferred_close_scheduled = true;
+					spin_unlock(&cinode->deferred_lock);
+					return 0;
+				}
 			}
 			spin_unlock(&cinode->deferred_lock);
 			_cifsFileInfo_put(cfile, true, false);

Re: [PATCH] smb: client: fix cifsFileInfo reference leak in deferred close

[Paulo Alcantara]

Fan Wu <fanwu01@zju.edu.cn> writes:

> When cifs_close() defers a close, it hands the cifsFileInfo reference
> of the closing struct file to the queued work. Each execution of
> smb2_deferred_work_close() drops one such reference.
>
> deferred_close_scheduled can be false while the work is pending: the
> workqueue clears PENDING when the callback starts to run, before the
> callback clears the flag under deferred_lock. A close in that
> interval requeues the running work, and the callback then clears the
> flag, leaving the requeued work pending with the flag down. A later
> cifs_open() can reuse the handle and its cifs_close() reaches the
> same branch: queue_delayed_work() fails because the work is still
> pending, but cifs_close() returns without dropping the closing file's
> reference. The cifsFileInfo count stays pinned and its tlink, dentry
> and server handle are leaked.
>
> Check the return value and hand off the reference only when work was
> actually queued. Otherwise, use the shared _cifsFileInfo_put(), like
> the mod_delayed_work() branch above: the pending execution already
> owns its reference.
> ...

Applied.