From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f66.google.com (mail-wm1-f66.google.com [209.85.128.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B18373B8BB4 for ; Fri, 6 Feb 2026 13:40:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.66 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770385205; cv=none; b=fmJ4g/Ay2CYDKf4QkWJZbXah0M7cuydr74p2DzemHCQ7VenUHcXJ4bqq4bQfDf/Cx3R1+xhinSxTIgcFig07wAoy0iECqszuyifybaDTwEbpEX4PO5sakkn4oRNM+vImjzBsrJeaZNUupvD3yX1lNB5ZiTJ37nuJgq3D5NvMQ2c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770385205; c=relaxed/simple; bh=fmfBq2o4g4tObxxsrNDH0cEhvdgnZy49nOEZWj1UhW0=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition:In-Reply-To; b=iL+LW1uteelOHSVHwFd0yyUDuXsPocNymx6KmVBB6tD1LUVEdD45RU5z7jcQ9pn/DOM/nq+auekD8UL4YVSK9kPO4Zev/ptBxX7sMrrIfGJpsZHPvK8eDR80lJYLCby190zcvsT+78AuxvA85Zn4bvmyplcfCyYZfkOr3IZOoEQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=YmGEwNgj; arc=none smtp.client-ip=209.85.128.66 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="YmGEwNgj" Received: by mail-wm1-f66.google.com with SMTP id 5b1f17b1804b1-4801d7c72a5so6541955e9.0 for ; Fri, 06 Feb 2026 05:40:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1770385203; x=1770990003; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:message-id:subject:cc :to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=3eVyUey35Vma5A1SdsPwo4q4ftJl7JELFuX6WQZMdi4=; b=YmGEwNgjtvsRW0j+8Huv+vFiwmjp6sb+naDBQhgkSXsiJWb0WLz3vuXESLNNuEgVaI 1LXHn8lANeDrvVf2AfviqfDvueg++bOH3dd9+GjpO6c7IMeBvniepmHQ6vcUjpGIas2O JJ3+Liopv5fF5jzDub75N1byBPOY1OsYWJdqR0bqNCHcxa1G4Lfda++YMwoQUgHThlE3 8avIAHI/ORwsIJSEseduLESshuDEChAvYatLbC8Fhv3nl7kSDPfBg5Jx4IvZ+pYgE06m bAxdcVY+OwhbSWFVR7GNhR6mOT81q7j06Wv7BRZ4Fpsos4tvkEgd4wPxRC9USAVasMl3 7QaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770385203; x=1770990003; h=in-reply-to:content-disposition:mime-version:message-id:subject:cc :to:from:date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=3eVyUey35Vma5A1SdsPwo4q4ftJl7JELFuX6WQZMdi4=; b=L2HotBUvAuT6ZWkI0H6lKhotlNZGwotiSxmdA5KzpssSgpDGgRbfL+RiaUhL3G0f9B 1Jdu6J3vSDED0Zr2umu2mqvxBXUD5VtKYJ03E3L3H3GPxkCOPLlUTgCqvEdU5n+QFTIS 8J9URAB5CFLtmDac3YaKzaBCd/q8uQc4wZaJ5P/Pf+k+ZRj1Qr9cxyiyd7letTMfv1Uu KTftlxFxUnoYa29IDp2wlGk+9cHk26IGrXA6FLNpt2+baa4znqL45dv4ufvHgRQkck5h uB9QGeISSQFriE4mK3CyWQbWVWPQCWORoryUUyG+ikl8pdKr1ZKCOI8rs0qZ7wh0WJbh GyUQ== X-Forwarded-Encrypted: i=1; AJvYcCXeGPC61pJ4Nl8n2ryekUFzBPrxZjTPeY9QeRI3de6XAM7zjiGeqrFQdICkgijXP15swopT704+YLFZqls=@vger.kernel.org X-Gm-Message-State: AOJu0Yy/NnVG6YY6LaWaA23ye6CDZugagzobNs1SjMdLOQlKkUZ130qj clZdKY/BM+Hzv83lOKnICWnNI3qOHEDnN5lFRERcDsVaI5DoXa7GKSX8CgjDnwRpwb0= X-Gm-Gg: AZuq6aJd2Yl8xXMw+1hlfkx+vLzoWETpuNidyeLHKcHSOVWdd31da/UdRsxB1YGZaHV Qv6nP2m4Gzw2Wf1FyMvHvu2Z9+edU9JSrKSlfNb2122+KIQb9kA7F7nJm2aNQZC5VTFREjjPLR3 6wNlD7yqOMfe8vvBTf6eOdOV9ouSt7xxvmghTmXcPMiOW6KLCDxMR8B2645VgmvEMprEZtlKCFZ HEvyzlMkYRKJll31jF1b0kA6IFdg2CqwI7Ow49D12pnCVlxfF8GHxeYQ85rPNWmhSIl2d5Vr2wP pQ7Q9pmrvpoE1Gb9f5tQqHA7wljtFXbmuHUBo/xur8tEYAV0u8n2C2hRcMpsEa+XfrqWcycqasF 1xzyL95YhZ2+1x9D8DEWPg1huCOsXoST9il4he8uZ5TAvujjsdkwt7XAM3119DxBZRU6OztqJji t8uiDQFiWVgrgpWV0R X-Received: by 2002:a05:600c:c165:b0:45c:4470:271c with SMTP id 5b1f17b1804b1-48320213840mr39214825e9.18.1770385202974; Fri, 06 Feb 2026 05:40:02 -0800 (PST) Received: from localhost ([196.207.164.177]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-483203d60d0sm21545935e9.1.2026.02.06.05.40.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Feb 2026 05:40:02 -0800 (PST) Date: Fri, 6 Feb 2026 16:39:59 +0300 From: Dan Carpenter To: Shyam Prasad N Cc: Paulo Alcantara , Ronnie Sahlberg , Shyam Prasad N , Tom Talpey , Bharath SM , linux-cifs@vger.kernel.org, samba-technical@lists.samba.org, linux-kernel Subject: [bug report] cifs: Fix locking usage for tcon fields Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: [ Smatch checking is paused while we raise funding. #SadFace https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ] Hello Shyam Prasad N, Commit 91c866a6abb0 ("cifs: Fix locking usage for tcon fields") from Feb 1, 2026 (linux-next), leads to the following Smatch static checker warning: fs/smb/client/smb2ops.c:3179 smb2_get_dfs_refer() error: dereferencing freed memory 'tcon' (line 3178) fs/smb/client/smb2ops.c 3079 static int 3080 smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses, 3081 const char *search_name, 3082 struct dfs_info3_param **target_nodes, 3083 unsigned int *num_of_nodes, 3084 const struct nls_table *nls_codepage, int remap) 3085 { 3086 int rc; 3087 __le16 *utf16_path = NULL; 3088 int utf16_path_len = 0; 3089 struct cifs_tcon *tcon; 3090 struct fsctl_get_dfs_referral_req *dfs_req = NULL; 3091 struct get_dfs_referral_rsp *dfs_rsp = NULL; 3092 u32 dfs_req_size = 0, dfs_rsp_size = 0; 3093 int retry_once = 0; 3094 3095 cifs_dbg(FYI, "%s: path: %s\n", __func__, search_name); 3096 3097 /* 3098 * Try to use the IPC tcon, otherwise just use any 3099 */ 3100 tcon = ses->tcon_ipc; 3101 if (tcon == NULL) { 3102 spin_lock(&cifs_tcp_ses_lock); 3103 tcon = list_first_entry_or_null(&ses->tcon_list, 3104 struct cifs_tcon, 3105 tcon_list); 3106 if (tcon) { 3107 spin_lock(&tcon->tc_lock); 3108 tcon->tc_count++; 3109 spin_unlock(&tcon->tc_lock); 3110 trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, 3111 netfs_trace_tcon_ref_get_dfs_refer); 3112 } 3113 spin_unlock(&cifs_tcp_ses_lock); 3114 } 3115 3116 if (tcon == NULL) { 3117 cifs_dbg(VFS, "session %p has no tcon available for a dfs referral request\n", 3118 ses); 3119 rc = -ENOTCONN; 3120 goto out; 3121 } 3122 3123 utf16_path = cifs_strndup_to_utf16(search_name, PATH_MAX, 3124 &utf16_path_len, 3125 nls_codepage, remap); 3126 if (!utf16_path) { 3127 rc = -ENOMEM; 3128 goto out; 3129 } 3130 3131 dfs_req_size = sizeof(*dfs_req) + utf16_path_len; 3132 dfs_req = kzalloc(dfs_req_size, GFP_KERNEL); 3133 if (!dfs_req) { 3134 rc = -ENOMEM; 3135 goto out; 3136 } 3137 3138 /* Highest DFS referral version understood */ 3139 dfs_req->MaxReferralLevel = DFS_VERSION; 3140 3141 /* Path to resolve in an UTF-16 null-terminated string */ 3142 memcpy(dfs_req->RequestFileName, utf16_path, utf16_path_len); 3143 3144 for (;;) { 3145 rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, 3146 FSCTL_DFS_GET_REFERRALS, 3147 (char *)dfs_req, dfs_req_size, CIFSMaxBufSize, 3148 (char **)&dfs_rsp, &dfs_rsp_size); 3149 if (fatal_signal_pending(current)) { 3150 rc = -EINTR; 3151 break; 3152 } 3153 if (!is_retryable_error(rc) || retry_once++) 3154 break; 3155 usleep_range(512, 2048); 3156 } 3157 3158 if (!rc && !dfs_rsp) 3159 rc = smb_EIO(smb_eio_trace_dfsref_no_rsp); 3160 if (rc) { 3161 if (!is_retryable_error(rc) && rc != -ENOENT && rc != -EOPNOTSUPP) 3162 cifs_tcon_dbg(FYI, "%s: ioctl error: rc=%d\n", __func__, rc); 3163 goto out; 3164 } 3165 3166 rc = parse_dfs_referrals(dfs_rsp, dfs_rsp_size, 3167 num_of_nodes, target_nodes, 3168 nls_codepage, remap, search_name, 3169 true /* is_unicode */); 3170 if (rc && rc != -ENOENT) { 3171 cifs_tcon_dbg(VFS, "%s: failed to parse DFS referral %s: %d\n", 3172 __func__, search_name, rc); 3173 } 3174 3175 out: 3176 if (tcon && !tcon->ipc) { 3177 /* ipc tcons are not refcounted */ 3178 cifs_put_tcon(tcon, netfs_trace_tcon_ref_put_dfs_refer); ^^^^ This free --> 3179 trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ needs to happen after these dereferences. 3180 netfs_trace_tcon_ref_dec_dfs_refer); 3181 } 3182 kfree(utf16_path); 3183 kfree(dfs_req); 3184 kfree(dfs_rsp); 3185 return rc; 3186 } regards, dan carpenter