Re: [PATCH] smb: client: pin DFS superblock in iterator callback

[Paulo Alcantara]

Karl Mehltretter <kmehltretter@xxxxxxxxx> writes:

> tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super()
> takes its active reference only after iterate_supers_type() has dropped
> s_umount and its passive reference. Concurrent DFS automount expiry can
> therefore free the superblock before cifs_sb_active() uses it.
>
> A deterministic KASAN test reproduces the race as:
>
>   BUG: KASAN: slab-use-after-free in cifs_sb_active+0x77/0x80
>
> The same test passes with this change applied.
>
> Take the active reference in the callback while iterate_supers_type()
> still holds s_umount shared. cifs_put_tcp_super() remains the matching
> release.
> ...

Applied.