tree: git://github.com/smfrench/smb3-kernel.git for-next head: 28711a66701e3aefc5748dcde38dba1e2e79de34 commit: a6649da5f02a578a9a4b1fccf3402cc9cf378ede [14/18] cifs: avoid race during socket reconnect between send and recv config: x86_64-randconfig-m001-20211119 (attached as .config) compiler: gcc-9 (Debian 9.3.0-22) 9.3.0 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com&gt; smatch warnings: fs/cifs/smb2pdu.c:341 smb2_reconnect() error: uninitialized symbol 'rc'. vim +/rc +341 fs/cifs/smb2pdu.c ec2e4523fdba88 Pavel Shilovsky 2011-12-27 141 static int 352d96f3acc6e0 Aurelien Aptel 2020-05-31 142 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, 352d96f3acc6e0 Aurelien Aptel 2020-05-31 143 struct TCP_Server_Info *server) ec2e4523fdba88 Pavel Shilovsky 2011-12-27 144 { 7ffbe65578b44f Paulo Alcantara 2018-07-05 145 int rc; aa24d1e9692411 Pavel Shilovsky 2011-12-27 146 struct nls_table *nls_codepage; aa24d1e9692411 Pavel Shilovsky 2011-12-27 147 struct cifs_ses *ses; a3a53b7603798f Paulo Alcantara 2018-11-14 148 int retries; aa24d1e9692411 Pavel Shilovsky 2011-12-27 149 aa24d1e9692411 Pavel Shilovsky 2011-12-27 150 /* aa24d1e9692411 Pavel Shilovsky 2011-12-27 151 * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so aa24d1e9692411 Pavel Shilovsky 2011-12-27 152 * check for tcp and smb session status done differently aa24d1e9692411 Pavel Shilovsky 2011-12-27 153 * for those three - in the calling routine. aa24d1e9692411 Pavel Shilovsky 2011-12-27 154 */ aa24d1e9692411 Pavel Shilovsky 2011-12-27 155 if (tcon == NULL) 7ffbe65578b44f Paulo Alcantara 2018-07-05 156 return 0; aa24d1e9692411 Pavel Shilovsky 2011-12-27 157 c88f7dcd6d6429 Paulo Alcantara 2021-11-03 158 /* c88f7dcd6d6429 Paulo Alcantara 2021-11-03 159 * Need to also skip SMB2_IOCTL because it is used for checking nested dfs links in c88f7dcd6d6429 Paulo Alcantara 2021-11-03 160 * cifs_tree_connect(). c88f7dcd6d6429 Paulo Alcantara 2021-11-03 161 */ c88f7dcd6d6429 Paulo Alcantara 2021-11-03 162 if (smb2_command == SMB2_TREE_CONNECT || smb2_command == SMB2_IOCTL) 7ffbe65578b44f Paulo Alcantara 2018-07-05 163 return 0; aa24d1e9692411 Pavel Shilovsky 2011-12-27 164 46c2db2a208986 Steve French 2021-11-19 165 spin_lock(&cifs_tcp_ses_lock); aa24d1e9692411 Pavel Shilovsky 2011-12-27 166 if (tcon->tidStatus == CifsExiting) { aa24d1e9692411 Pavel Shilovsky 2011-12-27 167 /* aa24d1e9692411 Pavel Shilovsky 2011-12-27 168 * only tree disconnect, open, and write, aa24d1e9692411 Pavel Shilovsky 2011-12-27 169 * (and ulogoff which does not have tcon) aa24d1e9692411 Pavel Shilovsky 2011-12-27 170 * are allowed as we start force umount. aa24d1e9692411 Pavel Shilovsky 2011-12-27 171 */ aa24d1e9692411 Pavel Shilovsky 2011-12-27 172 if ((smb2_command != SMB2_WRITE) && aa24d1e9692411 Pavel Shilovsky 2011-12-27 173 (smb2_command != SMB2_CREATE) && aa24d1e9692411 Pavel Shilovsky 2011-12-27 174 (smb2_command != SMB2_TREE_DISCONNECT)) { 46c2db2a208986 Steve French 2021-11-19 175 spin_unlock(&cifs_tcp_ses_lock); f96637be081141 Joe Perches 2013-05-04 176 cifs_dbg(FYI, "can not send cmd %d while umounting\n", aa24d1e9692411 Pavel Shilovsky 2011-12-27 177 smb2_command); aa24d1e9692411 Pavel Shilovsky 2011-12-27 178 return -ENODEV; aa24d1e9692411 Pavel Shilovsky 2011-12-27 179 } aa24d1e9692411 Pavel Shilovsky 2011-12-27 180 } 46c2db2a208986 Steve French 2021-11-19 181 spin_unlock(&cifs_tcp_ses_lock); aa24d1e9692411 Pavel Shilovsky 2011-12-27 182 if ((!tcon->ses) || (tcon->ses->status == CifsExiting) || 352d96f3acc6e0 Aurelien Aptel 2020-05-31 183 (!tcon->ses->server) || !server) aa24d1e9692411 Pavel Shilovsky 2011-12-27 184 return -EIO; aa24d1e9692411 Pavel Shilovsky 2011-12-27 185 aa24d1e9692411 Pavel Shilovsky 2011-12-27 186 ses = tcon->ses; a3a53b7603798f Paulo Alcantara 2018-11-14 187 retries = server->nr_targets; a3a53b7603798f Paulo Alcantara 2018-11-14 188 aa24d1e9692411 Pavel Shilovsky 2011-12-27 189 /* a3a53b7603798f Paulo Alcantara 2018-11-14 190 * Give demultiplex thread up to 10 seconds to each target available for a3a53b7603798f Paulo Alcantara 2018-11-14 191 * reconnect -- should be greater than cifs socket timeout which is 7 a3a53b7603798f Paulo Alcantara 2018-11-14 192 * seconds. aa24d1e9692411 Pavel Shilovsky 2011-12-27 193 */ aa24d1e9692411 Pavel Shilovsky 2011-12-27 194 while (server->tcpStatus == CifsNeedReconnect) { aa24d1e9692411 Pavel Shilovsky 2011-12-27 195 /* aa24d1e9692411 Pavel Shilovsky 2011-12-27 196 * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE aa24d1e9692411 Pavel Shilovsky 2011-12-27 197 * here since they are implicitly done when session drops. aa24d1e9692411 Pavel Shilovsky 2011-12-27 198 */ aa24d1e9692411 Pavel Shilovsky 2011-12-27 199 switch (smb2_command) { aa24d1e9692411 Pavel Shilovsky 2011-12-27 200 /* aa24d1e9692411 Pavel Shilovsky 2011-12-27 201 * BB Should we keep oplock break and add flush to exceptions? aa24d1e9692411 Pavel Shilovsky 2011-12-27 202 */ aa24d1e9692411 Pavel Shilovsky 2011-12-27 203 case SMB2_TREE_DISCONNECT: aa24d1e9692411 Pavel Shilovsky 2011-12-27 204 case SMB2_CANCEL: aa24d1e9692411 Pavel Shilovsky 2011-12-27 205 case SMB2_CLOSE: aa24d1e9692411 Pavel Shilovsky 2011-12-27 206 case SMB2_OPLOCK_BREAK: aa24d1e9692411 Pavel Shilovsky 2011-12-27 207 return -EAGAIN; aa24d1e9692411 Pavel Shilovsky 2011-12-27 208 } aa24d1e9692411 Pavel Shilovsky 2011-12-27 209 7ffbe65578b44f Paulo Alcantara 2018-07-05 210 rc = wait_event_interruptible_timeout(server->response_q, 7ffbe65578b44f Paulo Alcantara 2018-07-05 211 (server->tcpStatus != CifsNeedReconnect), 7ffbe65578b44f Paulo Alcantara 2018-07-05 212 10 * HZ); 7ffbe65578b44f Paulo Alcantara 2018-07-05 213 if (rc < 0) { a0a3036b81f1f6 Joe Perches 2020-04-14 214 cifs_dbg(FYI, "%s: aborting reconnect due to a received signal by the process\n", a0a3036b81f1f6 Joe Perches 2020-04-14 215 __func__); 7ffbe65578b44f Paulo Alcantara 2018-07-05 216 return -ERESTARTSYS; 7ffbe65578b44f Paulo Alcantara 2018-07-05 217 } aa24d1e9692411 Pavel Shilovsky 2011-12-27 218 aa24d1e9692411 Pavel Shilovsky 2011-12-27 219 /* are we still trying to reconnect? */ 46c2db2a208986 Steve French 2021-11-19 220 spin_lock(&cifs_tcp_ses_lock); 46c2db2a208986 Steve French 2021-11-19 221 if (server->tcpStatus != CifsNeedReconnect) { 46c2db2a208986 Steve French 2021-11-19 222 spin_unlock(&cifs_tcp_ses_lock); aa24d1e9692411 Pavel Shilovsky 2011-12-27 223 break; 46c2db2a208986 Steve French 2021-11-19 224 } 46c2db2a208986 Steve French 2021-11-19 225 spin_unlock(&cifs_tcp_ses_lock); aa24d1e9692411 Pavel Shilovsky 2011-12-27 226 c54849ddd832ae Ronnie Sahlberg 2020-01-31 227 if (retries && --retries) a3a53b7603798f Paulo Alcantara 2018-11-14 228 continue; a3a53b7603798f Paulo Alcantara 2018-11-14 229 aa24d1e9692411 Pavel Shilovsky 2011-12-27 230 /* aa24d1e9692411 Pavel Shilovsky 2011-12-27 231 * on "soft" mounts we wait once. Hard mounts keep aa24d1e9692411 Pavel Shilovsky 2011-12-27 232 * retrying until process is killed or server comes aa24d1e9692411 Pavel Shilovsky 2011-12-27 233 * back on-line aa24d1e9692411 Pavel Shilovsky 2011-12-27 234 */ aa24d1e9692411 Pavel Shilovsky 2011-12-27 235 if (!tcon->retry) { f96637be081141 Joe Perches 2013-05-04 236 cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n"); aa24d1e9692411 Pavel Shilovsky 2011-12-27 237 return -EHOSTDOWN; aa24d1e9692411 Pavel Shilovsky 2011-12-27 238 } a3a53b7603798f Paulo Alcantara 2018-11-14 239 retries = server->nr_targets; aa24d1e9692411 Pavel Shilovsky 2011-12-27 240 } aa24d1e9692411 Pavel Shilovsky 2011-12-27 241 2e1950bf3a3683 Steve French 2021-11-19 242 spin_lock(&ses->chan_lock); 2e1950bf3a3683 Steve French 2021-11-19 243 if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) { 2e1950bf3a3683 Steve French 2021-11-19 244 spin_unlock(&ses->chan_lock); 7ffbe65578b44f Paulo Alcantara 2018-07-05 245 return 0; 2e1950bf3a3683 Steve French 2021-11-19 246 } 2e1950bf3a3683 Steve French 2021-11-19 247 cifs_dbg(FYI, "sess reconnect mask: 0x%lx, tcon reconnect: %d", 2e1950bf3a3683 Steve French 2021-11-19 248 tcon->ses->chans_need_reconnect, 2e1950bf3a3683 Steve French 2021-11-19 249 tcon->need_reconnect); 2e1950bf3a3683 Steve French 2021-11-19 250 spin_unlock(&ses->chan_lock); aa24d1e9692411 Pavel Shilovsky 2011-12-27 251 aa24d1e9692411 Pavel Shilovsky 2011-12-27 252 nls_codepage = load_nls_default(); aa24d1e9692411 Pavel Shilovsky 2011-12-27 253 76e752701a8af4 Samuel Cabrero 2017-07-11 254 /* 76e752701a8af4 Samuel Cabrero 2017-07-11 255 * Recheck after acquire mutex. If another thread is negotiating 76e752701a8af4 Samuel Cabrero 2017-07-11 256 * and the server never sends an answer the socket will be closed 76e752701a8af4 Samuel Cabrero 2017-07-11 257 * and tcpStatus set to reconnect. 76e752701a8af4 Samuel Cabrero 2017-07-11 258 */ 46c2db2a208986 Steve French 2021-11-19 259 spin_lock(&cifs_tcp_ses_lock); 76e752701a8af4 Samuel Cabrero 2017-07-11 260 if (server->tcpStatus == CifsNeedReconnect) { 46c2db2a208986 Steve French 2021-11-19 261 spin_unlock(&cifs_tcp_ses_lock); 76e752701a8af4 Samuel Cabrero 2017-07-11 262 rc = -EHOSTDOWN; 76e752701a8af4 Samuel Cabrero 2017-07-11 263 goto out; 76e752701a8af4 Samuel Cabrero 2017-07-11 264 } 46c2db2a208986 Steve French 2021-11-19 265 spin_unlock(&cifs_tcp_ses_lock); 76e752701a8af4 Samuel Cabrero 2017-07-11 266 2e1950bf3a3683 Steve French 2021-11-19 267 /* 2e1950bf3a3683 Steve French 2021-11-19 268 * need to prevent multiple threads trying to simultaneously 2e1950bf3a3683 Steve French 2021-11-19 269 * reconnect the same SMB session 2e1950bf3a3683 Steve French 2021-11-19 270 */ 2e1950bf3a3683 Steve French 2021-11-19 271 spin_lock(&ses->chan_lock); 2e1950bf3a3683 Steve French 2021-11-19 272 if (!cifs_chan_needs_reconnect(ses, server)) { 2e1950bf3a3683 Steve French 2021-11-19 273 spin_unlock(&ses->chan_lock); 2e1950bf3a3683 Steve French 2021-11-19 274 0d0119cf6ce4eb Steve French 2021-11-19 275 /* this means that we only need to tree connect */ 2e1950bf3a3683 Steve French 2021-11-19 276 if (tcon->need_reconnect) 2e1950bf3a3683 Steve French 2021-11-19 277 goto skip_sess_setup; 2e1950bf3a3683 Steve French 2021-11-19 278 2e1950bf3a3683 Steve French 2021-11-19 279 goto out; ^^^^^^^^ "rc" not necessarily set for this gotos. 2e1950bf3a3683 Steve French 2021-11-19 280 } 2e1950bf3a3683 Steve French 2021-11-19 281 spin_unlock(&ses->chan_lock); 2e1950bf3a3683 Steve French 2021-11-19 282 b8272812b48c94 Shyam Prasad N 2021-07-19 283 mutex_lock(&ses->session_mutex); 0d0119cf6ce4eb Steve French 2021-11-19 284 rc = cifs_negotiate_protocol(0, ses, server); 2e1950bf3a3683 Steve French 2021-11-19 285 if (!rc) { 0d0119cf6ce4eb Steve French 2021-11-19 286 rc = cifs_setup_session(0, ses, server, nls_codepage); b0dd940e582b6a Ronnie Sahlberg 2020-02-05 287 if ((rc == -EACCES) && !tcon->retry) { 0d0119cf6ce4eb Steve French 2021-11-19 288 mutex_unlock(&ses->session_mutex); b8272812b48c94 Shyam Prasad N 2021-07-19 289 rc = -EHOSTDOWN; b0dd940e582b6a Ronnie Sahlberg 2020-02-05 290 goto failed; b0dd940e582b6a Ronnie Sahlberg 2020-02-05 291 } b0dd940e582b6a Ronnie Sahlberg 2020-02-05 292 } 2f58967979409e Aurelien Aptel 2020-04-24 293 aa24d1e9692411 Pavel Shilovsky 2011-12-27 294 if (rc || !tcon->need_reconnect) { b8272812b48c94 Shyam Prasad N 2021-07-19 295 mutex_unlock(&ses->session_mutex); aa24d1e9692411 Pavel Shilovsky 2011-12-27 296 goto out; aa24d1e9692411 Pavel Shilovsky 2011-12-27 297 } aa24d1e9692411 Pavel Shilovsky 2011-12-27 298 2e1950bf3a3683 Steve French 2021-11-19 299 skip_sess_setup: aa24d1e9692411 Pavel Shilovsky 2011-12-27 300 cifs_mark_open_files_invalid(tcon); 96a988ffeb90db Pavel Shilovsky 2016-11-29 301 if (tcon->use_persistent) 96a988ffeb90db Pavel Shilovsky 2016-11-29 302 tcon->need_reopen_files = true; 52ace1ef1259e1 Steve French 2016-09-22 303 565674d613d7f4 Stefan Metzmacher 2020-07-21 304 rc = cifs_tree_connect(0, tcon, nls_codepage); b8272812b48c94 Shyam Prasad N 2021-07-19 305 mutex_unlock(&ses->session_mutex); 52ace1ef1259e1 Steve French 2016-09-22 306 f96637be081141 Joe Perches 2013-05-04 307 cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc); c318e6c26cbe91 Steve French 2018-04-04 308 if (rc) { c318e6c26cbe91 Steve French 2018-04-04 309 /* If sess reconnected but tcon didn't, something strange ... */ a0a3036b81f1f6 Joe Perches 2020-04-14 310 pr_warn_once("reconnect tcon failed rc = %d\n", rc); aa24d1e9692411 Pavel Shilovsky 2011-12-27 311 goto out; c318e6c26cbe91 Steve French 2018-04-04 312 } 96a988ffeb90db Pavel Shilovsky 2016-11-29 313 96a988ffeb90db Pavel Shilovsky 2016-11-29 314 if (smb2_command != SMB2_INTERNAL_CMD) b08484d715128a Stefan Metzmacher 2020-02-24 315 mod_delayed_work(cifsiod_wq, &server->reconnect, 0); 96a988ffeb90db Pavel Shilovsky 2016-11-29 316 aa24d1e9692411 Pavel Shilovsky 2011-12-27 317 atomic_inc(&tconInfoReconnectCount); aa24d1e9692411 Pavel Shilovsky 2011-12-27 318 out: aa24d1e9692411 Pavel Shilovsky 2011-12-27 319 /* aa24d1e9692411 Pavel Shilovsky 2011-12-27 320 * Check if handle based operation so we know whether we can continue aa24d1e9692411 Pavel Shilovsky 2011-12-27 321 * or not without returning to caller to reset file handle. aa24d1e9692411 Pavel Shilovsky 2011-12-27 322 */ aa24d1e9692411 Pavel Shilovsky 2011-12-27 323 /* aa24d1e9692411 Pavel Shilovsky 2011-12-27 324 * BB Is flush done by server on drop of tcp session? Should we special aa24d1e9692411 Pavel Shilovsky 2011-12-27 325 * case it and skip above? aa24d1e9692411 Pavel Shilovsky 2011-12-27 326 */ aa24d1e9692411 Pavel Shilovsky 2011-12-27 327 switch (smb2_command) { aa24d1e9692411 Pavel Shilovsky 2011-12-27 328 case SMB2_FLUSH: aa24d1e9692411 Pavel Shilovsky 2011-12-27 329 case SMB2_READ: aa24d1e9692411 Pavel Shilovsky 2011-12-27 330 case SMB2_WRITE: aa24d1e9692411 Pavel Shilovsky 2011-12-27 331 case SMB2_LOCK: aa24d1e9692411 Pavel Shilovsky 2011-12-27 332 case SMB2_IOCTL: aa24d1e9692411 Pavel Shilovsky 2011-12-27 333 case SMB2_QUERY_DIRECTORY: aa24d1e9692411 Pavel Shilovsky 2011-12-27 334 case SMB2_CHANGE_NOTIFY: aa24d1e9692411 Pavel Shilovsky 2011-12-27 335 case SMB2_QUERY_INFO: aa24d1e9692411 Pavel Shilovsky 2011-12-27 336 case SMB2_SET_INFO: 4772c79599564b Pavel Shilovsky 2016-11-29 337 rc = -EAGAIN; aa24d1e9692411 Pavel Shilovsky 2011-12-27 338 } b0dd940e582b6a Ronnie Sahlberg 2020-02-05 339 failed: aa24d1e9692411 Pavel Shilovsky 2011-12-27 340 unload_nls(nls_codepage); ec2e4523fdba88 Pavel Shilovsky 2011-12-27 @341 return rc; ec2e4523fdba88 Pavel Shilovsky 2011-12-27 342 } --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org