From: Winston Wen <wentao@uniontech.com> mainline inclusion from mainline-v6.5-rc1 commit 99f280700b4cc02d5f141b8d15f8e9fad0418f65 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11378 CVE: CVE-2023-53794 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- Don't collect exiting session in smb2_reconnect_server(), because it will be released soon. Note that the exiting session will stay in server->smb_ses_list until it complete the cifs_free_ipc() and logoff() and then delete itself from the list. Signed-off-by: Winston Wen <wentao@uniontech.com> Reviewed-by: Shyam Prasad N <sprasad@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com> Conflicts: fs/cifs/smb2pdu.c fs/smb/client/smb2pdu.c [The code has been refactored multiple times.] Signed-off-by: Wang Zhaolong <wangzhaolong@huaweicloud.com> --- fs/cifs/smb2pdu.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 696c84632617..ffc9ac29f40e 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -3712,10 +3712,17 @@ void smb2_reconnect_server(struct work_struct *work) INIT_LIST_HEAD(&tmp_list); cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n"); spin_lock(&cifs_tcp_ses_lock); list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { + spin_lock(&GlobalMid_Lock); + if (ses->status == CifsExiting) { + spin_unlock(&GlobalMid_Lock); + continue; + } + spin_unlock(&GlobalMid_Lock); + list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { if (tcon->need_reconnect || tcon->need_reopen_files) { tcon->tc_count++; list_add_tail(&tcon->rlist, &tmp_list); tcon_exist = true; -- 2.34.3