RHEL7: panic handing cifs reconnect in cifs_send_recv or smb2_reconnect due to a use after free of struct cifs_ses

Solution In Progress - Updated -

Issue

  • kernel crashed with one of the following logs:
  • crash log 1
[3391089.999306] general protection fault: 0000 [#1] SMP 
[3391090.008015] Workqueue: cifsiod smb2_reconnect_server [cifs]
[3391090.010236] RIP: 0010:[<ffffffffc07c5599>]  [<ffffffffc07c5599>] cifs_send_recv+0x2b9/0x3d0 [cifs]
  • crash log 2
[87704.045236] CPU: 38 PID: 84826 Comm: kworker/38:3 Kdump: loaded Tainted: P           OEL ------------   3.10.0-957.5.1.el7.x86_64 #1
[87704.045237] Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 06/07/2018
[87704.045250] Workqueue: cifsiod smb2_reconnect_server [cifs]
[87704.045252] task: ffff8f9356e691a0 ti: ffff8f992d688000 task.ti: ffff8f992d688000
[87704.045254] RIP: 0010:[<ffffffffc1b4ac88>]  [<ffffffffc1b4ac88>] smb2_reconnect+0x58/0x440 [cifs]

Environment

  • Red Hat Enterprise Linux 7
  • Seen on kernel-3.10.0-957.5.1.el7
  • cifs
    • mount options: vers=3.0 or vers=2.1 and multiuser
  • network issues leading to cifs having to reconnect

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In