[lvc-project] [PATCH 2/3] ksmbd: fix uninitialized xarrays in __session_create() error path

[Dmitriy Okunev]

In __session_create(), the tree_conns, ksmbd_chann_list and
rpc_handle_list xarrays are initialized with xa_init() after the
ksmbd_init_file_table() call. If ksmbd_init_file_table() fails, the
error path calls ksmbd_session_destroy(), which in turn calls
ksmbd_tree_conn_session_logoff().  That function runs
xa_destroy(&sess->tree_conns), which tries to take the xarray's
internal spinlock - uninitialized because xa_init() has not run yet:

  INFO: trying to register non-static key.
  ...
  _raw_spin_lock_irqsave+0x3a/0x60
  xa_destroy+0xbe/0x360
  ksmbd_tree_conn_session_logoff+0x174/0x1f0
  ksmbd_session_destroy+0xaf/0x390
  ksmbd_smb2_session_create+0x131/0x160
  smb2_sess_setup+0xde4/0x6fd0
  ...

Move the three xa_init() calls above ksmbd_init_file_table(), the same
way the rwsem initialization was moved, so that all xarrays are
valid on every error path.

Found by Linux Verification Center (linuxtesting.org).

Fixes: 02b68b2065c9 ("cifsd: use xarray instead of linked list for tree connect list")
Signed-off-by: Dmitriy Okunev <dokunevdmitriy at gmail.com>
---
 fs/smb/server/mgmt/user_session.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c
index fc28088772ac..386c8629e134 100644
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -844,6 +844,9 @@ static struct ksmbd_session *__session_create(int protocol)
 
 	ida_init(&sess->tree_conn_ida);
 
+	xa_init(&sess->tree_conns);
+	xa_init(&sess->ksmbd_chann_list);
+	xa_init(&sess->rpc_handle_list);
 	init_rwsem(&sess->tree_conns_lock);
 	init_rwsem(&sess->rpc_lock);
 	init_rwsem(&sess->chann_lock);
@@ -854,9 +857,6 @@ static struct ksmbd_session *__session_create(int protocol)
 	sess->last_active = jiffies;
 	sess->state = SMB2_SESSION_IN_PROGRESS;
 	set_session_flag(sess, protocol);
-	xa_init(&sess->tree_conns);
-	xa_init(&sess->ksmbd_chann_list);
-	xa_init(&sess->rpc_handle_list);
 	sess->sequence_number = 1;
 	atomic_set(&sess->refcnt, 2);
 
-- 
2.53.0