• Pavel Shilovsky's avatar
    CIFS: Fix use after free of file info structures · 1a67c415
    Pavel Shilovsky authored
    Currently the code assumes that if a file info entry belongs
    to lists of open file handles of an inode and a tcon then
    it has non-zero reference. The recent changes broke that
    assumption when putting the last reference of the file info.
    There may be a situation when a file is being deleted but
    nothing prevents another thread to reference it again
    and start using it. This happens because we do not hold
    the inode list lock while checking the number of references
    of the file info structure. Fix this by doing the proper
    locking when doing the check.
    
    Fixes: 487317c9 ("cifs: add spinlock for the openFileList to cifsInodeInfo")
    Fixes: cb248819 ("cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic")
    Cc: Stable <stable@vger.kernel.org>
    Reviewed-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
    Signed-off-by: default avatarPavel Shilovsky <pshilov@microsoft.com>
    Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
    1a67c415
file.c 119 KB