Skip to content

Commit 0fa757b

Browse files
committed
smb3: prevent races updating CurrentMid
There was one place where we weren't locking CurrentMid, and although likely to be safe since even without the lock since it is during negotiate protocol, it is more consistent to lock it in this last remaining place, and avoids confusing Coverity warning. Addresses-Coverity: 1486665 ("Data race condition") Signed-off-by: Steve French <[email protected]>
1 parent 0060a4f commit 0fa757b

File tree

2 files changed

+4
-1
lines changed

2 files changed

+4
-1
lines changed

fs/cifs/cifsglob.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -621,7 +621,7 @@ struct TCP_Server_Info {
621621
/* SMB_COM_WRITE_RAW or SMB_COM_READ_RAW. */
622622
unsigned int capabilities; /* selective disabling of caps by smb sess */
623623
int timeAdj; /* Adjust for difference in server time zone in sec */
624-
__u64 CurrentMid; /* multiplex id - rotating counter */
624+
__u64 CurrentMid; /* multiplex id - rotating counter, protected by GlobalMid_Lock */
625625
char cryptkey[CIFS_CRYPTO_KEY_SIZE]; /* used by ntlm, ntlmv2 etc */
626626
/* 16th byte of RFC1001 workstation name is always null */
627627
char workstation_RFC1001_name[RFC1001_NAME_LEN_WITH_NULL];
@@ -1786,6 +1786,7 @@ require use of the stronger protocol */
17861786
* updates to XID counters, multiplex id and SMB sequence numbers
17871787
* list operations on global DnotifyReqList
17881788
* updates to ses->status
1789+
* updates to server->CurrentMid
17891790
* tcp_ses_lock protects:
17901791
* list operations on tcp and SMB session lists
17911792
* tcon->open_file_lock protects the list of open files hanging off the tcon

fs/cifs/smb2ops.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -388,7 +388,9 @@ smb2_negotiate(const unsigned int xid, struct cifs_ses *ses)
388388
{
389389
int rc;
390390

391+
spin_lock(&GlobalMid_Lock);
391392
cifs_ses_server(ses)->CurrentMid = 0;
393+
spin_unlock(&GlobalMid_Lock);
392394
rc = SMB2_negotiate(xid, ses);
393395
/* BB we probably don't need to retry with modern servers */
394396
if (rc == -EAGAIN)

0 commit comments

Comments
 (0)