linux_dsm_epyc7002/fs
Pavel Shilovsky 86a7964be7 CIFS: Fix NULL pointer dereference in mid callback
There is a race between a system call processing thread
and the demultiplex thread when mid->resp_buf becomes NULL
and later is being accessed to get credits. It happens when
the 1st thread wakes up before a mid callback is called in
the 2nd one but the mid state has already been set to
MID_RESPONSE_RECEIVED. This causes NULL pointer dereference
in mid callback.

Fix this by saving credits from the response before we
update the mid state and then use this value in the mid
callback rather then accessing a response buffer.

Cc: Stable <stable@vger.kernel.org>
Fixes: ee258d7915 ("CIFS: Move credit processing to mid callbacks for SMB3")
Tested-by: Frank Sorenson <sorenson@redhat.com>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
2019-11-25 01:14:53 -06:00
..
9p 9p pull request for inclusion in 5.4 2019-09-27 15:10:34 -07:00
adfs
affs
afs afs: Fix large file support 2019-11-22 14:19:26 -08:00
autofs autofs: fix a leak in autofs_expire_indirect() 2019-10-25 00:03:11 -04:00
befs
bfs
btrfs for-5.4-rc7-tag 2019-11-13 12:06:10 -08:00
cachefiles
ceph ceph: increment/decrement dio counter on async requests 2019-11-14 18:44:51 +01:00
cifs CIFS: Fix NULL pointer dereference in mid callback 2019-11-25 01:14:53 -06:00
coda y2038: add inode timestamp clamping 2019-09-19 09:42:37 -07:00
configfs configfs: calculate the depth of parent item 2019-11-06 18:36:01 +01:00
cramfs cramfs: fix usage on non-MTD device 2019-11-23 21:44:49 -05:00
crypto
debugfs Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2019-09-28 08:14:15 -07:00
devpts
dlm
ecryptfs ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either 2019-11-10 11:57:45 -05:00
efivarfs
efs
erofs erofs: fix mis-inplace determination related with noio chain 2019-10-01 04:54:45 +08:00
exportfs exportfs_decode_fh(): negative pinned may become positive without the parent locked 2019-11-10 11:56:05 -05:00
ext2 \n 2019-09-21 13:53:34 -07:00
ext4 Merge branch 'entropy' 2019-09-29 19:25:39 -07:00
f2fs f2fs-for-5.4-rc1 2019-09-21 14:26:33 -07:00
fat fat: delete an unnecessary check before brelse() 2019-09-25 17:51:40 -07:00
freevxfs
fscache
fuse fuse: redundant get_fuse_inode() calls in fuse_writepages_fill() 2019-10-23 14:26:37 +02:00
gfs2 gfs2: Fix initialisation of args for remount 2019-10-30 12:16:53 +01:00
hfs
hfsplus
hostfs
hpfs
hugetlbfs
iomap iomap: move the iomap_dio_rw ->end_io callback into a structure 2019-09-19 15:32:45 -07:00
isofs y2038: add inode timestamp clamping 2019-09-19 09:42:37 -07:00
jbd2 jbd2: remove jbd2_journal_inode_add_[write|wait] 2019-09-24 15:54:07 -07:00
jffs2 Merge branch 'work.mount3' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-09-26 11:33:30 -07:00
jfs y2038: add inode timestamp clamping 2019-09-19 09:42:37 -07:00
kernfs y2038: add inode timestamp clamping 2019-09-19 09:42:37 -07:00
lockd
minix
nfs NFS: Fix an RCU lock leak in nfs4_refresh_delegation_stateid() 2019-11-01 11:03:56 -04:00
nfs_common
nfsd Highlights: 2019-09-27 17:00:27 -07:00
nilfs2
nls
notify Highlights: 2019-09-27 17:00:27 -07:00
ntfs ntfs: remove (un)?likely() from IS_ERR() conditions 2019-09-26 10:10:44 -07:00
ocfs2 Revert "fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()" 2019-11-22 09:11:18 -08:00
omfs
openpromfs
orangefs Orangefs: a fix and a cleanup 2019-09-19 10:21:35 -07:00
overlayfs
proc proc/meminfo: fix output alignment 2019-10-19 06:32:32 -04:00
pstore
qnx4
qnx6
quota
ramfs
reiserfs fs/reiserfs/do_balan.c: remove set but not used variable 2019-09-25 17:51:40 -07:00
romfs Merge branch 'work.mount2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-09-19 10:06:57 -07:00
squashfs Merge branch 'work.mount2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-09-19 10:06:57 -07:00
sysfs
sysv
tracefs tracing: Do not create tracefs files if tracefs lockdown is in effect 2019-10-12 20:49:07 -04:00
ubifs This pull request contains the following changes for UBI, UBIFS and JFFS2: 2019-09-21 11:10:16 -07:00
udf
ufs y2038: add inode timestamp clamping 2019-09-19 09:42:37 -07:00
unicode
verity
xfs xfs: change the seconds fields in xfs_bulkstat to signed 2019-10-15 08:46:07 -07:00
aio.c aio: Fix io_pgetevents() struct __compat_aio_sigset layout 2019-10-21 19:12:19 -04:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c elf: don't use MAP_FIXED_NOREPLACE for elf executable mappings 2019-10-06 13:53:27 -07:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
block_dev.c Changes for 5.4: 2019-09-18 17:35:20 -07:00
buffer.c
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c
compat.c
coredump.c
d_path.c
dax.c fs/dax: Fix pmd vs pte conflict detection 2019-10-22 22:53:02 -07:00
dcache.c
dcookies.c
direct-io.c fs/direct-io.c: fix kernel-doc warning 2019-10-14 15:04:01 -07:00
drop_caches.c
eventfd.c
eventpoll.c
exec.c sched/membarrier: Fix p->mm->membarrier_state racy load 2019-09-25 17:42:30 +02:00
fcntl.c
fhandle.c
file_table.c
file.c
filesystems.c
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg is dead 2019-11-08 13:37:24 -07:00
fsopen.c
inode.c mm,thp: avoid writes to file with THP in pagecache 2019-09-24 15:54:11 -07:00
internal.h
io_uring.c io_uring: ensure registered buffer import returns the IO length 2019-11-13 16:15:14 -07:00
ioctl.c
Kconfig fs-verity for 5.4 2019-09-18 16:59:14 -07:00
Kconfig.binfmt
libfs.c fs/libfs.c: fix kernel-doc warning 2019-10-14 15:04:01 -07:00
locks.c Highlights: 2019-09-27 17:00:27 -07:00
Makefile fs-verity for 5.4 2019-09-18 16:59:14 -07:00
mbcache.c
mount.h
mpage.c
namei.c
namespace.c fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry() 2019-10-16 23:15:09 -04:00
no-block.c
nsfs.c
open.c fs: remove unlikely() from WARN_ON() condition 2019-09-26 10:10:30 -07:00
pipe.c
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c filldir[64]: remove WARN_ON_ONCE() for bad directory entries 2019-10-18 18:41:16 -04:00
select.c
seq_file.c
signalfd.c
splice.c
stack.c
stat.c
statfs.c vfs: Fix EOVERFLOW testing in put_compat_statfs64 2019-10-03 14:21:35 -07:00
super.c Merge branch 'work.mount3' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-10-10 08:16:44 -07:00
sync.c
timerfd.c
userfaultfd.c userfaultfd: untag user pointers 2019-09-25 17:51:41 -07:00
utimes.c
xattr.c