Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 29 Aug 2019 14:02:37 +0900
From:   Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
To:     Steve French <stfrench@microsoft.com>,
        Ronnie Sahlberg <lsahlber@redhat.com>
Cc:     linux-cifs@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: build_path_from_dentry_optional_prefix() may schedule from invalid
 context
Message-ID: <20190829050237.GA5161@jagdpanzerIV>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.12.1 (2019-06-15)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hello,

Looking at commit "cifs: create a helper to find a writeable handle
by path name":

->open_file_lock scope is atomic context, while build_path_from_dentry()
can schedule - kmalloc(GFP_KERNEL)

       spin_lock(&tcon->open_file_lock);
       list_for_each(tmp, &tcon->openFileList) {
               cfile = list_entry(tmp, struct cifsFileInfo,
                            tlist);
               full_path = build_path_from_dentry(cfile->dentry);
               if (full_path == NULL) {
                       spin_unlock(&tcon->open_file_lock);
                       return -ENOMEM;
               }
               if (strcmp(full_path, name)) {
                       kfree(full_path);
                       continue;
               }
               kfree(full_path);

               cinode = CIFS_I(d_inode(cfile->dentry));
               spin_unlock(&tcon->open_file_lock);
               return cifs_get_writable_file(cinode, 0, ret_file);
       }

       spin_unlock(&tcon->open_file_lock);

Additionally, kfree() can (and should) be done outside of
->open_file_lock scope.

	-ss