smb: client: fix double put of @CFILE in smb2_rename_path()

jira LE-2974
cve CVE-2024-46736
Rebuild_History Non-Buildable kernel-5.14.0-503.40.1.el9_5
commit-author Paulo Alcantara <pc@manguebit.com>
commit 3523a3d

If smb2_set_path_attr() is called with a valid @CFILE and returned
-EINVAL, we need to call cifs_get_writable_path() again as the
reference of @CFILE was already dropped by previous smb2_compound_op()
call.

Fixes: 71f15c9 ("smb: client: retry compound request without reusing lease")
	Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
	Cc: David Howells <dhowells@redhat.com>
	Signed-off-by: Steve French <stfrench@microsoft.com>
(cherry picked from commit 3523a3d)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>

Author: PlaidCat

fs/smb/client/smb2inode.c

@@ -1106,6 +1106,8 @@ int smb2_rename_path(const unsigned int xid,
 				  co, DELETE, SMB2_OP_RENAME, cfile, source_dentry);
 	if (rc == -EINVAL) {
 		cifs_dbg(FYI, "invalid lease key, resending request without lease");
+		cifs_get_writable_path(tcon, from_name,
+				       FIND_WR_WITH_DELETE, &cfile);
 		rc = smb2_set_path_attr(xid, tcon, from_name, to_name, cifs_sb,
 				  co, DELETE, SMB2_OP_RENAME, cfile, NULL);
 	}