smb: client: fix potential deadlock when releasing mids
authorPaulo Alcantara <pc@manguebit.com>
Wed, 25 Oct 2023 17:58:35 +0000 (14:58 -0300)
committerSteve French <stfrench@microsoft.com>
Tue, 31 Oct 2023 17:38:02 +0000 (12:38 -0500)
commite6322fd177c6885a21dd4609dc5e5c973d1a2eb7
treeef37d8ba5db90d1c2eda090137ac422df0ad8d87
parent72bc63f5e23a38b65ff2a201bdc11401d4223fa9
smb: client: fix potential deadlock when releasing mids

All release_mid() callers seem to hold a reference of @mid so there is
no need to call kref_put(&mid->refcount, __release_mid) under
@server->mid_lock spinlock.  If they don't, then an use-after-free bug
would have occurred anyways.

By getting rid of such spinlock also fixes a potential deadlock as
shown below

CPU 0                                CPU 1
------------------------------------------------------------------
cifs_demultiplex_thread()            cifs_debug_data_proc_show()
 release_mid()
  spin_lock(&server->mid_lock);
                                     spin_lock(&cifs_tcp_ses_lock)
      spin_lock(&server->mid_lock)
  __release_mid()
   smb2_find_smb_tcon()
    spin_lock(&cifs_tcp_ses_lock) *deadlock*

Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
fs/smb/client/cifsproto.h
fs/smb/client/smb2misc.c
fs/smb/client/transport.c