From 77aae7c038a6bfa803bdc36aabe51c78f6f10faa Mon Sep 17 00:00:00 2001 From: Enzo Matsumiya Date: Sat, 29 Jun 2024 10:01:28 +0800 Subject: [PATCH] smb: client: fix deadlock in smb2_find_smb_tcon() mainline inclusion from mainline-v6.10-rc3 commit 02c418774f76a0a36a6195c9dbf8971eb4130a15 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AFZ CVE: CVE-2024-39468 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=02c418774f76a0a36a6195c9dbf8971eb4130a15 -------------------------------- Unlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such deadlock. Cc: stable@vger.kernel.org Signed-off-by: Enzo Matsumiya Reviewed-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French Signed-off-by: Wang Zhaolong --- fs/smb/client/smb2transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/smb/client/smb2transport.c b/fs/smb/client/smb2transport.c index 8f346aafc4cf..4ca04e62a993 100644 --- a/fs/smb/client/smb2transport.c +++ b/fs/smb/client/smb2transport.c @@ -216,8 +216,8 @@ smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid) } tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid); if (!tcon) { - cifs_put_smb_ses(ses); spin_unlock(&cifs_tcp_ses_lock); + cifs_put_smb_ses(ses); return NULL; } spin_unlock(&cifs_tcp_ses_lock); -- Gitee