smb: client: fix deadlock in smb2_find_smb_tcon() [ Upstream commit 02c418774f76a0a36a6195c9dbf8971eb4130a15 ] Unlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such deadlock. BUG=b/364558453 TEST=presubmit RELEASE_NOTE=Fixes CVE-2024-39468 in the Linux kernel cos-patch: security-moderate Cc: stable@vger.kernel.org Change-Id: I4120254521986a33e01398619506b7ed12c192dc Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de> Reviewed-by: Shyam Prasad N <sprasad@microsoft.com> Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Kernel CVE Triage Automation <cloud-image-kernel-cve-triage-automation@prod.google.com> Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/80064 Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com> Reviewed-by: Oleksandr Tymoshenko <ovt@google.com> Reviewed-by: Michael Kochera <kochera@google.com>
diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c index 0f2e0ce..ffae3a7 100644 --- a/fs/cifs/smb2transport.c +++ b/fs/cifs/smb2transport.c
@@ -194,8 +194,8 @@ smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid) } tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid); if (!tcon) { - cifs_put_smb_ses(ses); spin_unlock(&cifs_tcp_ses_lock); + cifs_put_smb_ses(ses); return NULL; } spin_unlock(&cifs_tcp_ses_lock);