Skip to content

Commit 7f9d45a

Browse files
committed
SMB3: fix lease break timeout when multiple deferred close handles for the same file.
jira VULN-131073 cve-pre CVE-2025-38527 commit-author Bharath SM <bharathsm@microsoft.com> commit 9e31678 Solution is to send lease break ack immediately even in case of deferred close handles to avoid lease break request timing out and let deferred closed handle gets closed as scheduled. Later patches could optimize cases where we then close some of these handles sooner for the cases where lease break is to 'none' Cc: stable@kernel.org Signed-off-by: Bharath SM <bharathsm@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com> (cherry picked from commit 9e31678) Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>
1 parent 992dcf5 commit 7f9d45a

File tree

1 file changed

+1
-19
lines changed

1 file changed

+1
-19
lines changed

fs/cifs/file.c

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -5053,8 +5053,6 @@ void cifs_oplock_break(struct work_struct *work)
50535053
struct TCP_Server_Info *server = tcon->ses->server;
50545054
int rc = 0;
50555055
bool purge_cache = false;
5056-
bool is_deferred = false;
5057-
struct cifs_deferred_close *dclose;
50585056

50595057
wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS,
50605058
TASK_UNINTERRUPTIBLE);
@@ -5090,22 +5088,6 @@ void cifs_oplock_break(struct work_struct *work)
50905088
cifs_dbg(VFS, "Push locks rc = %d\n", rc);
50915089

50925090
oplock_break_ack:
5093-
/*
5094-
* When oplock break is received and there are no active
5095-
* file handles but cached, then schedule deferred close immediately.
5096-
* So, new open will not use cached handle.
5097-
*/
5098-
spin_lock(&CIFS_I(inode)->deferred_lock);
5099-
is_deferred = cifs_is_deferred_close(cfile, &dclose);
5100-
spin_unlock(&CIFS_I(inode)->deferred_lock);
5101-
if (is_deferred &&
5102-
cfile->deferred_close_scheduled &&
5103-
delayed_work_pending(&cfile->deferred)) {
5104-
if (cancel_delayed_work(&cfile->deferred)) {
5105-
_cifsFileInfo_put(cfile, false, false);
5106-
goto oplock_break_done;
5107-
}
5108-
}
51095091
/*
51105092
* releasing stale oplock after recent reconnect of smb session using
51115093
* a now incorrect file handle is not a data integrity issue but do
@@ -5117,7 +5099,7 @@ void cifs_oplock_break(struct work_struct *work)
51175099
cinode);
51185100
cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
51195101
}
5120-
oplock_break_done:
5102+
51215103
_cifsFileInfo_put(cfile, false /* do not wait for ourself */, false);
51225104
cifs_done_oplock_break(cinode);
51235105
}

0 commit comments

Comments
 (0)