aboutsummaryrefslogtreecommitdiffstats
path: root/fs/cifs/connect.c
diff options
context:
space:
mode:
authorPavel Shilovsky <pshilov@microsoft.com>2019-11-21 11:35:14 -0800
committerSteve French <stfrench@microsoft.com>2019-11-25 01:14:53 -0600
commit7b71843fa7028475b052107664cbe120156a2cfc (patch)
tree01de54f71dde647272b02b670f5e3a130b65e340 /fs/cifs/connect.c
parentCIFS: Fix NULL pointer dereference in mid callback (diff)
downloadlinux-dev-7b71843fa7028475b052107664cbe120156a2cfc.tar.xz
linux-dev-7b71843fa7028475b052107664cbe120156a2cfc.zip
CIFS: Do not miss cancelled OPEN responses
When an OPEN command is cancelled we mark a mid as cancelled and let the demultiplex thread process it by closing an open handle. The problem is there is a race between a system call thread and the demultiplex thread and there may be a situation when the mid has been already processed before it is set as cancelled. Fix this by processing cancelled requests when mids are being destroyed which means that there is only one thread referencing a particular mid. Also set mids as cancelled unconditionally on their state. Cc: Stable <stable@vger.kernel.org> Tested-by: Frank Sorenson <sorenson@redhat.com> Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com> Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com>
Diffstat (limited to '')
-rw-r--r--fs/cifs/connect.c6
1 files changed, 0 insertions, 6 deletions
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 40b2a173ba0d..a7a026795bc2 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1237,12 +1237,6 @@ next_pdu:
for (i = 0; i < num_mids; i++) {
if (mids[i] != NULL) {
mids[i]->resp_buf_size = server->pdu_size;
- if ((mids[i]->mid_flags & MID_WAIT_CANCELLED) &&
- mids[i]->mid_state == MID_RESPONSE_RECEIVED &&
- server->ops->handle_cancelled_mid)
- server->ops->handle_cancelled_mid(
- mids[i]->resp_buf,
- server);
if (!mids[i]->multiRsp || mids[i]->multiEnd)
mids[i]->callback(mids[i]);