Commit 5eef12c4 authored Nov 14, 2023 by Shyam Prasad N Committed by Steve French Nov 14, 2023

cifs: fix lock ordering while disabling multichannel



The code to handle the case of server disabling multichannel
was picking iface_lock with chan_lock held. This goes against
the lock ordering rules, as iface_lock is a higher order lock
(even if it isn't so obvious).

This change fixes the lock ordering by doing the following in
that order for each secondary channel:
1. store iface and server pointers in local variable
2. remove references to iface and server in channels
3. unlock chan_lock
4. lock iface_lock
5. dec ref count for iface
6. unlock iface_lock
7. dec ref count for server
8. lock chan_lock again

Since this function can only be called in smb2_reconnect, and
that cannot be called by two parallel processes, we should not
have races due to dropping chan_lock between steps 3 and 8.

Fixes: ee1d2179 ("cifs: handle when server stops supporting multichannel")
Reported-by: Paulo Alcantara <pc@manguebit.com>
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

parent 29954d5b

fs/smb/client/sess.c

+13 −9

Original line number	Diff line number	Diff line
		@@ -322,28 +322,32 @@ cifs_disable_secondary_channels(struct cifs_ses *ses)
		iface = ses->chans[i].iface;
		server = ses->chans[i].server;

		/*
		* remove these references first, since we need to unlock
		* the chan_lock here, since iface_lock is a higher lock
		*/
		ses->chans[i].iface = NULL;
		ses->chans[i].server = NULL;
		spin_unlock(&ses->chan_lock);

		if (iface) {
		spin_lock(&ses->iface_lock);
		kref_put(&iface->refcount, release_iface);
		ses->chans[i].iface = NULL;
		iface->num_channels--;
		if (iface->weight_fulfilled)
		iface->weight_fulfilled--;
		spin_unlock(&ses->iface_lock);
		}

		spin_unlock(&ses->chan_lock);
		if (server && !server->terminate) {
		if (server) {
		if (!server->terminate) {
		server->terminate = true;
		cifs_signal_cifsd_for_reconnect(server, false);
		}
		spin_lock(&ses->chan_lock);

		if (server) {
		ses->chans[i].server = NULL;
		cifs_put_tcp_session(server, false);
		}

		spin_lock(&ses->chan_lock);
		}

		done: