Commit c707193a authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Steve French
Browse files

Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" 

This reverts commit 4e7f1644.

The commit e9f2517a ("smb: client: fix TCP timers deadlock after
rmmod") is not only a bogus fix for LOCKDEP null-ptr-deref but also
introduces a real issue, TCP sockets leak, which will be explained in
detail in the next revert.

Also, CNA assigned CVE-2024-54680 to it but is rejecting it. [0]

Thus, we are reverting the commit and its follow-up commit 4e7f1644
("smb: client: Fix netns refcount imbalance causing leaks and
use-after-free").

Link: https://lore.kernel.org/all/2025040248-tummy-smilingly-4240@gregkh/

 #[0]
Fixes: 4e7f1644 ("smb: client: Fix netns refcount imbalance causing leaks and use-after-free")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 262b73ef

fs/smb/client/connect.c

+8 −8
Original line number Diff line number Diff line
@@ -300,7 +300,6 @@ cifs_abort_connection(struct TCP_Server_Info *server) 
			 server->ssocket->flags);

		sock_release(server->ssocket);

		server->ssocket = NULL;

		put_net(cifs_net_ns(server));

	}

	server->sequence_number = 0;

	server->session_estab = false;
@@ -3369,11 +3368,7 @@ generic_ip_connect(struct TCP_Server_Info *server) 
		/*

		 * Grab netns reference for the socket.

		 *

		 * This reference will be released in several situations:

		 * - In the failure path before the cifsd thread is started.

		 * - In the all place where server->socket is released, it is

		 *   also set to NULL.

		 * - Ultimately in clean_demultiplex_info(), during the final

		 * It'll be released here, on error, or in clean_demultiplex_info() upon server

		 * teardown.

		 */

		get_net(net);
@@ -3390,8 +3385,10 @@ generic_ip_connect(struct TCP_Server_Info *server) 
	}



	rc = bind_socket(server);

	if (rc < 0)

	if (rc < 0) {

		put_net(cifs_net_ns(server));

		return rc;

	}



	/*

	 * Eventually check for other socket options to change from
@@ -3446,6 +3443,9 @@ generic_ip_connect(struct TCP_Server_Info *server) 
	    (server->rfc1001_sessinit == -1 && sport == htons(RFC1001_PORT)))

		rc = ip_rfc1001_connect(server);



	if (rc < 0)

		put_net(cifs_net_ns(server));



	return rc;

}