In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb: client: avoid leaking refcount in cifs_queue_oplock_break()<\/p>\n
cifs_queue_oplock_break() unconditionally takes a reference on the
\ntarget file before queueing cifs_oplock_break(). Only that work item
\ndecreases the reference counter again.<\/p>\n
If another oplock break arrives while that work is still queued,
\nqueue_work() will return false and not queue this second work item. As a
\nresult, we will never reach the point to drop the file reference again
\nand are leaking this reference. This can be triggered when interacting
\nwith a slow-responding server.<\/p>\n
As a result, later unmount operations for this file system will fail with<\/p>\n
BUG: Dentry … still in use (1) [unmount of cifs cifs]
\n VFS: Busy inodes after unmount of cifs (cifs)
\n kernel BUG at fs\/super.c:777!<\/p>\n
Fix this by only incrementing the reference count if the work has been
\nqueued successfully. Taking it after queue_work() is safe because all
\nthree callers hold tcon->open_file_lock across the call and
\n_cifsFileInfo_put() decrements under that same lock, so a worker that
\nstarts the handler in the window cannot drop the reference before it has
\nbeen taken.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb: client: avoid leaking refcount in cifs_queue_oplock_break()<\/p>\n
cifs_queue_oplock_break() unconditionally takes a reference on th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28989","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28989","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28989"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28989"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28989"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}