| Message ID | 20230615040131.13444-1-islituo@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | smb: fix a possible data race in cifs_can_echo() | expand |
diff --git a/fs/smb/client/smb1ops.c b/fs/smb/client/smb1ops.c index 7d1b3fc014d9..b258af1a75fe 100644 --- a/fs/smb/client/smb1ops.c +++ b/fs/smb/client/smb1ops.c @@ -1049,8 +1049,11 @@ cifs_dir_needs_close(struct cifsFileInfo *cfile) static bool cifs_can_echo(struct TCP_Server_Info *server) { - if (server->tcpStatus == CifsGood) + spin_lock(&server->srv_lock); + if (server->tcpStatus == CifsGood) { + spin_unlock(&server->srv_lock); return true; + } return false; }
The struct field TCP_Server_Info.tcpStatus is often protected by the lock srv_lock when is accessed. Here is an example in __cifs_reconnect(): spin_lock(&server->srv_lock); if (server->tcpStatus != CifsExiting) server->tcpStatus = CifsNeedNegotiate; spin_unlock(&server->srv_lock); However, the variable server->tcpStatus is accessed without holding the lock server->srv_lock in cifs_can_echo(): if (server->tcpStatus == CifsGood) return true; To fix this possible data race, a lock and unlock pair is added when accessing the variable server->tcpStatus. Reported-by: BassCheck <bass@buaa.edu.cn> Signed-off-by: Tuo Li <islituo@gmail.com> --- fs/smb/client/smb1ops.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)