Skip to content

Commit

Permalink
smb3: Handle error case during offload read path
Browse files Browse the repository at this point in the history
Mid callback needs to be called only when valid data is
read into pages.

These patches address a problem found during decryption offload:
      CIFS: VFS: trying to dequeue a deleted mid
that could cause a refcount use after free:
      Workqueue: smb3decryptd smb2_decrypt_offload [cifs]

Signed-off-by: Rohith Surabattula <rohiths@microsoft.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
CC: Stable <stable@vger.kernel.org> #5.4+
Signed-off-by: Steve French <stfrench@microsoft.com>
  • Loading branch information
rohiths-msft authored and Steve French committed Nov 16, 2020
1 parent ac873aa commit 1254100
Showing 1 changed file with 19 additions and 1 deletion.
20 changes: 19 additions & 1 deletion fs/cifs/smb2ops.c
Original file line number Diff line number Diff line change
Expand Up @@ -4559,7 +4559,25 @@ static void smb2_decrypt_offload(struct work_struct *work)
dw->server->vals->read_rsp_size,
dw->ppages, dw->npages, dw->len,
true);
mid->callback(mid);
if (rc >= 0) {
#ifdef CONFIG_CIFS_STATS2
mid->when_received = jiffies;
#endif
mid->callback(mid);
} else {
spin_lock(&GlobalMid_Lock);
if (dw->server->tcpStatus == CifsNeedReconnect) {
mid->mid_state = MID_RETRY_NEEDED;
spin_unlock(&GlobalMid_Lock);
mid->callback(mid);
} else {
mid->mid_state = MID_REQUEST_SUBMITTED;
mid->mid_flags &= ~(MID_DELETED);
list_add_tail(&mid->qhead,
&dw->server->pending_mid_q);
spin_unlock(&GlobalMid_Lock);
}
}
cifs_mid_q_entry_release(mid);
}

Expand Down

0 comments on commit 1254100

Please sign in to comment.