Merge tag '6.1-rc6-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull cifs fixes from Steve French:
 "Two small cifs/smb3 client fixes:

   - an unlock missing in an error path in copychunk_range found by
     xfstest 476

   - a fix for a use after free in a debug code path"

* tag '6.1-rc6-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: fix missing unlock in cifs_file_copychunk_range()
  cifs: Use after free in debug code

diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index fe220686bba4f0bdb2cd1eadf4d45181aa04fe2e..712a431614480d082cd6cb24683a6bc378e27df7 100644 (file)
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1281,7 +1281,7 @@ ssize_t cifs_file_copychunk_range(unsigned int xid,
        rc = filemap_write_and_wait_range(src_inode->i_mapping, off,
                                          off + len - 1);
        if (rc)
-               goto out;
+               goto unlock;
 
        /* should we flush first and last page first */
        truncate_inode_pages(&target_inode->i_data, 0);
@@ -1297,6 +1297,8 @@ ssize_t cifs_file_copychunk_range(unsigned int xid,
         * that target is updated on the server
         */
        CIFS_I(target_inode)->time = 0;
+
+unlock:
        /* although unlocking in the reverse order from locking is not
         * strictly necessary here it is a little cleaner to be consistent
         */

diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 92e4278ec35d536714a440a6193c35a9721ec5eb..9e7d9f0baa18a133eb1afd76a4916d7f47d00dd2 100644 (file)
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -302,14 +302,14 @@ cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
 
        /* now drop the ref to the current iface */
        if (old_iface && iface) {
-               kref_put(&old_iface->refcount, release_iface);
                cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
                         &old_iface->sockaddr,
                         &iface->sockaddr);
-       } else if (old_iface) {
                kref_put(&old_iface->refcount, release_iface);
+       } else if (old_iface) {
                cifs_dbg(FYI, "releasing ref to iface: %pIS\n",
                         &old_iface->sockaddr);
+               kref_put(&old_iface->refcount, release_iface);
        } else {
                WARN_ON(!iface);
                cifs_dbg(FYI, "adding new iface: %pIS\n", &iface->sockaddr);