Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1551212

[PATCH 4.9 68/83] CIFS: Fix a possible memory corruption during reconnect

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.9 68/83] CIFS: Fix a possible memory corruption during reconnect
Date 2017-01-04 21:30 +0100
Message-ID <sW0m5-1bZ-3@gated-at.bofh.it> (permalink)
References <sW02J-12y-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Pavel Shilovsky <pshilov@microsoft.com>

commit 53e0e11efe9289535b060a51d4cf37c25e0d0f2b upstream.

We can not unlock/lock cifs_tcp_ses_lock while walking through ses
and tcon lists because it can corrupt list iterator pointers and
a tcon structure can be released if we don't hold an extra reference.
Fix it by moving a reconnect process to a separate delayed work
and acquiring a reference to every tcon that needs to be reconnected.
Also do not send an echo request on newly established connections.

Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/cifsglob.h  |    3 ++
 fs/cifs/cifsproto.h |    3 ++
 fs/cifs/connect.c   |   34 ++++++++++++++++++-----
 fs/cifs/smb2pdu.c   |   75 +++++++++++++++++++++++++++++++++++-----------------
 fs/cifs/smb2proto.h |    1 
 5 files changed, 85 insertions(+), 31 deletions(-)

--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -646,6 +646,8 @@ struct TCP_Server_Info {
 	unsigned int	max_read;
 	unsigned int	max_write;
 	__u8		preauth_hash[512];
+	struct delayed_work reconnect; /* reconnect workqueue job */
+	struct mutex reconnect_mutex; /* prevent simultaneous reconnects */
 #endif /* CONFIG_CIFS_SMB2 */
 	unsigned long echo_interval;
 };
@@ -849,6 +851,7 @@ cap_unix(struct cifs_ses *ses)
 struct cifs_tcon {
 	struct list_head tcon_list;
 	int tc_count;
+	struct list_head rlist; /* reconnect list */
 	struct list_head openFileList;
 	spinlock_t open_file_lock; /* protects list above */
 	struct cifs_ses *ses;	/* pointer to session associated with */
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -206,6 +206,9 @@ extern void cifs_add_pending_open_locked
 					 struct tcon_link *tlink,
 					 struct cifs_pending_open *open);
 extern void cifs_del_pending_open(struct cifs_pending_open *open);
+extern void cifs_put_tcp_session(struct TCP_Server_Info *server,
+				 int from_reconnect);
+extern void cifs_put_tcon(struct cifs_tcon *tcon);
 
 #if IS_ENABLED(CONFIG_CIFS_DFS_UPCALL)
 extern void cifs_dfs_release_automount_timer(void);
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -52,6 +52,9 @@
 #include "nterr.h"
 #include "rfc1002pdu.h"
 #include "fscache.h"
+#ifdef CONFIG_CIFS_SMB2
+#include "smb2proto.h"
+#endif
 
 #define CIFS_PORT 445
 #define RFC1001_PORT 139
@@ -2100,8 +2103,8 @@ cifs_find_tcp_session(struct smb_vol *vo
 	return NULL;
 }
 
-static void
-cifs_put_tcp_session(struct TCP_Server_Info *server)
+void
+cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
 {
 	struct task_struct *task;
 
@@ -2118,6 +2121,19 @@ cifs_put_tcp_session(struct TCP_Server_I
 
 	cancel_delayed_work_sync(&server->echo);
 
+#ifdef CONFIG_CIFS_SMB2
+	if (from_reconnect)
+		/*
+		 * Avoid deadlock here: reconnect work calls
+		 * cifs_put_tcp_session() at its end. Need to be sure
+		 * that reconnect work does nothing with server pointer after
+		 * that step.
+		 */
+		cancel_delayed_work(&server->reconnect);
+	else
+		cancel_delayed_work_sync(&server->reconnect);
+#endif
+
 	spin_lock(&GlobalMid_Lock);
 	server->tcpStatus = CifsExiting;
 	spin_unlock(&GlobalMid_Lock);
@@ -2182,6 +2198,10 @@ cifs_get_tcp_session(struct smb_vol *vol
 	INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
 	INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
 	INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
+#ifdef CONFIG_CIFS_SMB2
+	INIT_DELAYED_WORK(&tcp_ses->reconnect, smb2_reconnect_server);
+	mutex_init(&tcp_ses->reconnect_mutex);
+#endif
 	memcpy(&tcp_ses->srcaddr, &volume_info->srcaddr,
 	       sizeof(tcp_ses->srcaddr));
 	memcpy(&tcp_ses->dstaddr, &volume_info->dstaddr,
@@ -2340,7 +2360,7 @@ cifs_put_smb_ses(struct cifs_ses *ses)
 	spin_unlock(&cifs_tcp_ses_lock);
 
 	sesInfoFree(ses);
-	cifs_put_tcp_session(server);
+	cifs_put_tcp_session(server, 0);
 }
 
 #ifdef CONFIG_KEYS
@@ -2514,7 +2534,7 @@ cifs_get_smb_ses(struct TCP_Server_Info
 		mutex_unlock(&ses->session_mutex);
 
 		/* existing SMB ses has a server reference already */
-		cifs_put_tcp_session(server);
+		cifs_put_tcp_session(server, 0);
 		free_xid(xid);
 		return ses;
 	}
@@ -2604,7 +2624,7 @@ cifs_find_tcon(struct cifs_ses *ses, con
 	return NULL;
 }
 
-static void
+void
 cifs_put_tcon(struct cifs_tcon *tcon)
 {
 	unsigned int xid;
@@ -3792,7 +3812,7 @@ mount_fail_check:
 		else if (ses)
 			cifs_put_smb_ses(ses);
 		else
-			cifs_put_tcp_session(server);
+			cifs_put_tcp_session(server, 0);
 		bdi_destroy(&cifs_sb->bdi);
 	}
 
@@ -4103,7 +4123,7 @@ cifs_construct_tcon(struct cifs_sb_info
 	ses = cifs_get_smb_ses(master_tcon->ses->server, vol_info);
 	if (IS_ERR(ses)) {
 		tcon = (struct cifs_tcon *)ses;
-		cifs_put_tcp_session(master_tcon->ses->server);
+		cifs_put_tcp_session(master_tcon->ses->server, 0);
 		goto out;
 	}
 
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1972,6 +1972,54 @@ smb2_echo_callback(struct mid_q_entry *m
 	add_credits(server, credits_received, CIFS_ECHO_OP);
 }
 
+void smb2_reconnect_server(struct work_struct *work)
+{
+	struct TCP_Server_Info *server = container_of(work,
+					struct TCP_Server_Info, reconnect.work);
+	struct cifs_ses *ses;
+	struct cifs_tcon *tcon, *tcon2;
+	struct list_head tmp_list;
+	int tcon_exist = false;
+
+	/* Prevent simultaneous reconnects that can corrupt tcon->rlist list */
+	mutex_lock(&server->reconnect_mutex);
+
+	INIT_LIST_HEAD(&tmp_list);
+	cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n");
+
+	spin_lock(&cifs_tcp_ses_lock);
+	list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
+		list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
+			if (tcon->need_reconnect) {
+				tcon->tc_count++;
+				list_add_tail(&tcon->rlist, &tmp_list);
+				tcon_exist = true;
+			}
+		}
+	}
+	/*
+	 * Get the reference to server struct to be sure that the last call of
+	 * cifs_put_tcon() in the loop below won't release the server pointer.
+	 */
+	if (tcon_exist)
+		server->srv_count++;
+
+	spin_unlock(&cifs_tcp_ses_lock);
+
+	list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) {
+		smb2_reconnect(SMB2_ECHO, tcon);
+		list_del_init(&tcon->rlist);
+		cifs_put_tcon(tcon);
+	}
+
+	cifs_dbg(FYI, "Reconnecting tcons finished\n");
+	mutex_unlock(&server->reconnect_mutex);
+
+	/* now we can safely release srv struct */
+	if (tcon_exist)
+		cifs_put_tcp_session(server, 1);
+}
+
 int
 SMB2_echo(struct TCP_Server_Info *server)
 {
@@ -1984,32 +2032,11 @@ SMB2_echo(struct TCP_Server_Info *server
 	cifs_dbg(FYI, "In echo request\n");
 
 	if (server->tcpStatus == CifsNeedNegotiate) {
-		struct list_head *tmp, *tmp2;
-		struct cifs_ses *ses;
-		struct cifs_tcon *tcon;
-
-		cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n");
-		spin_lock(&cifs_tcp_ses_lock);
-		list_for_each(tmp, &server->smb_ses_list) {
-			ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
-			list_for_each(tmp2, &ses->tcon_list) {
-				tcon = list_entry(tmp2, struct cifs_tcon,
-						  tcon_list);
-				/* add check for persistent handle reconnect */
-				if (tcon && tcon->need_reconnect) {
-					spin_unlock(&cifs_tcp_ses_lock);
-					rc = smb2_reconnect(SMB2_ECHO, tcon);
-					spin_lock(&cifs_tcp_ses_lock);
-				}
-			}
-		}
-		spin_unlock(&cifs_tcp_ses_lock);
+		/* No need to send echo on newly established connections */
+		queue_delayed_work(cifsiod_wq, &server->reconnect, 0);
+		return rc;
 	}
 
-	/* if no session, renegotiate failed above */
-	if (server->tcpStatus == CifsNeedNegotiate)
-		return -EIO;
-
 	rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req);
 	if (rc)
 		return rc;
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -96,6 +96,7 @@ extern int smb2_open_file(const unsigned
 extern int smb2_unlock_range(struct cifsFileInfo *cfile,
 			     struct file_lock *flock, const unsigned int xid);
 extern int smb2_push_mandatory_locks(struct cifsFileInfo *cfile);
+extern void smb2_reconnect_server(struct work_struct *work);
 
 /*
  * SMB2 Worker functions - most of protocol specific implementation details

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH 4.9 00/83] 4.9.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:20 +0100
  [PATCH 4.9 68/83] CIFS: Fix a possible memory corruption during reconnect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 26/83] ALSA: hda - Gate the mic jack on HP Z1 Gen3 AiO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 33/83] mm: Add a user_ns owner to mm_struct and fix ptrace permission checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 38/83] ext4: dont lock buffer in ext4_commit_super if holding spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 39/83] ext4: fix mballoc breakage with 64k block size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 17/83] usb: gadget: f_uac2: fix error handling at afunc_bind Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 41/83] ext4: use more strict checks for inodes_per_block on mount Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 36/83] ptrace: Dont allow accessing an undumpable mm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 56/83] PM / OPP: Pass opp_table to dev_pm_opp_put_regulator() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 35/83] ptrace: Capture the ptracers creds not PT_PTRACE_CAP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 42/83] ext4: fix in-superblock mount options processing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 40/83] ext4: fix stack memory corruption with 64k block size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 25/83] ALSA: hda - fix headset-mic problem on a Dell laptop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 64/83] dm raid: fix discard support regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 31/83] splice: reinstate SIGPIPE/EPIPE handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 59/83] dm table: fix all_blk_mq inconsistency when an empty table is loaded Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 34/83] vfs,mm: fix return value of read() at s_maxbytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 54/83] mm, page_alloc: keep pcp count and list contents in sync if struct page is corrupted Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 32/83] block_dev: dont test bdev->bd_contains when it is not stable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 13/83] USB: cdc-acm: add device id for GW Instek AFG-125 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 12/83] USB: serial: kl5kusb105: fix open error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 30/83] fs: exec: apply CLOEXEC before changing dumpable task flags Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 29/83] exec: Ensure mm->user_ns contains the execed files Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 62/83] dm crypt: mark key as invalid until properly loaded Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 28/83] clk: ti: omap36xx: Work around sprz319 advisory 2.1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 66/83] ASoC: intel: Fix crash at suspend/resume without card registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 43/83] ext4: add sanity checking to count_overhead() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 55/83] usb: gadget: composite: always set ep->mult to a sensible value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  [PATCH 4.9 58/83] blk-mq: Do not invoke .queue_rq() for a stopped queue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:30 +0100
  Re: [PATCH 4.9 00/83] 4.9.1-stable review Shuah Khan <shuah.kh@samsung.com> - 2017-01-05 01:50 +0100
    Re: [PATCH 4.9 00/83] 4.9.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-05 09:00 +0100
  Re: [PATCH 4.9 00/83] 4.9.1-stable review Guenter Roeck <linux@roeck-us.net> - 2017-01-05 06:00 +0100
    Re: [PATCH 4.9 00/83] 4.9.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-05 09:00 +0100

csiph-web