From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.4 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F22B3C433FE for ; Fri, 17 Sep 2021 02:35:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DB39761244 for ; Fri, 17 Sep 2021 02:35:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243131AbhIQCgX (ORCPT ); Thu, 16 Sep 2021 22:36:23 -0400 Received: from mail.kernel.org ([198.145.29.99]:33176 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243082AbhIQCfx (ORCPT ); Thu, 16 Sep 2021 22:35:53 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 2364B61139; Fri, 17 Sep 2021 02:34:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1631846071; bh=MXoU39SgCkMTrmTI3ONBlIn6o3fNAP/MsVmu1zC/SEU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=K3+mVtznC2zDQ6pkAqJGpvrx29Sb2EHbHw7oneghfL4XJcDaF/70oxnJwHfhLsJey I4xKvrNKJ75X8BfECXqHiUxQ/x5bCqgUcBA3pPdmgIA5luRu4vcfMcVGl0z2O3ViLb EPnNXk1Th0b+G852nhzFvganI+/5sV5a9tIGaTNzMVz23+/CcprVGTcV3BOOPvTl7H WINoyg+kUyANl3/5cxetkQLMJwNVqdlZjy+XZh1R9BRhvZDwSDYkB+ucFEQY8I+dz4 8GlRrHNTUXAp9zsNcCC8P6vfYL+5YfWIZHFLf4ZsNoxriF41Eq6tDqSx8VLChRag+c 1sUxSp7ceBosA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Enzo Matsumiya , Paulo Alcantara , Steve French , Sasha Levin , sfrench@samba.org Subject: [PATCH AUTOSEL 5.14 20/21] cifs: properly invalidate cached root handle when closing it Date: Thu, 16 Sep 2021 22:33:14 -0400 Message-Id: <20210917023315.816225-20-sashal@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210917023315.816225-1-sashal@kernel.org> References: <20210917023315.816225-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Enzo Matsumiya [ Upstream commit 9351590f51cdda49d0265932a37f099950998504 ] Cached root file was not being completely invalidated sometimes. Reproducing: - With a DFS share with 2 targets, one disabled and one enabled - start some I/O on the mount # while true; do ls /mnt/dfs; done - at the same time, disable the enabled target and enable the disabled one - wait for DFS cache to expire - on reconnect, the previous cached root handle should be invalid, but open_cached_dir_by_dentry() will still try to use it, but throws a use-after-free warning (kref_get()) Make smb2_close_cached_fid() invalidate all fields every time, but only send an SMB2_close() when the entry is still valid. Signed-off-by: Enzo Matsumiya Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French Signed-off-by: Sasha Levin --- fs/cifs/smb2ops.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 2dfd0d8297eb..1b9de38a136a 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -689,13 +689,19 @@ smb2_close_cached_fid(struct kref *ref) cifs_dbg(FYI, "clear cached root file handle\n"); SMB2_close(0, cfid->tcon, cfid->fid->persistent_fid, cfid->fid->volatile_fid); - cfid->is_valid = false; - cfid->file_all_info_is_valid = false; - cfid->has_lease = false; - if (cfid->dentry) { - dput(cfid->dentry); - cfid->dentry = NULL; - } + } + + /* + * We only check validity above to send SMB2_close, + * but we still need to invalidate these entries + * when this function is called + */ + cfid->is_valid = false; + cfid->file_all_info_is_valid = false; + cfid->has_lease = false; + if (cfid->dentry) { + dput(cfid->dentry); + cfid->dentry = NULL; } } -- 2.30.2