diff options
| author | Henrique Carvalho <henrique.carvalho@suse.com> | 2025-11-03 19:52:55 -0300 |
|---|---|---|
| committer | Steve French <stfrench@microsoft.com> | 2025-11-04 08:53:28 -0600 |
| commit | 734e99623c5b65bf2c03e35978a0b980ebc3c2f8 (patch) | |
| tree | ee0cbf5889c65127f42bfc7f9aaa75bd30ffa218 /net/unix/af_unix.c | |
| parent | 6146a0f1dfae5d37442a9ddcba012add260bceb0 (diff) | |
smb: client: fix potential UAF in smb2_close_cached_fid()
find_or_create_cached_dir() could grab a new reference after kref_put()
had seen the refcount drop to zero but before cfid_list_lock is acquired
in smb2_close_cached_fid(), leading to use-after-free.
Switch to kref_put_lock() so cfid_release() is called with
cfid_list_lock held, closing that gap.
Fixes: ebe98f1447bb ("cifs: enable caching of directories for which a lease is held")
Cc: stable@vger.kernel.org
Reported-by: Jay Shin <jaeshin@redhat.com>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to 'net/unix/af_unix.c')
0 files changed, 0 insertions, 0 deletions