]> asedeno.scripts.mit.edu Git - linux.git/commit
CIFS: Fix NULL pointer dereference in mid callback
authorPavel Shilovsky <pshilov@microsoft.com>
Thu, 21 Nov 2019 19:35:13 +0000 (11:35 -0800)
committerSteve French <stfrench@microsoft.com>
Mon, 25 Nov 2019 07:14:53 +0000 (01:14 -0600)
commit86a7964be7afaf3df6b64faaa10a7032d2444e51
tree5fcf70bf32a87191bd6c4f31a59544b6b7741d22
parent9150c3adbf24d77cfba37f03639d4a908ca4ac25
CIFS: Fix NULL pointer dereference in mid callback

There is a race between a system call processing thread
and the demultiplex thread when mid->resp_buf becomes NULL
and later is being accessed to get credits. It happens when
the 1st thread wakes up before a mid callback is called in
the 2nd one but the mid state has already been set to
MID_RESPONSE_RECEIVED. This causes NULL pointer dereference
in mid callback.

Fix this by saving credits from the response before we
update the mid state and then use this value in the mid
callback rather then accessing a response buffer.

Cc: Stable <stable@vger.kernel.org>
Fixes: ee258d79159afed5 ("CIFS: Move credit processing to mid callbacks for SMB3")
Tested-by: Frank Sorenson <sorenson@redhat.com>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/cifs/cifsglob.h
fs/cifs/connect.c
fs/cifs/smb2ops.c