diff options
| author | Karl Mehltretter <kmehltretter@gmail.com> | 2026-09-02 20:28:14 +0200 |
|---|---|---|
| committer | Paulo Alcantara <pc@manguebit.org> | 2026-09-02 20:24:25 -0300 |
| commit | d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818 (patch) | |
| tree | 213efe3a4d405bc66dd5a9170642085d797bf16c /scripts/basic | |
| parent | d9d7eeb0cea5b55b82888f443622fd8d4ee064f3 (diff) | |
| download | linux-d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818.tar.gz linux-d806d5a85dcbe2a0f181b2f0f9f61ddfbefa1818.zip | |
smb: client: pin DFS superblock in iterator callback
tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super()
takes its active reference only after iterate_supers_type() has dropped
s_umount and its passive reference. Concurrent DFS automount expiry can
therefore free the superblock before cifs_sb_active() uses it.
A deterministic KASAN test reproduces the race as:
BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80
The same test passes with this change applied.
Take the active reference in the callback while iterate_supers_type()
still holds s_umount shared. cifs_put_tcp_super() remains the matching
release.
Fixes: bacd704a95ad ("cifs: handle prefix paths in reconnect")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Paulo Alcantara <pc@manguebit.org>
Diffstat (limited to 'scripts/basic')
0 files changed, 0 insertions, 0 deletions