[PATCH] cifs: Fix server use-after-free in cifs_chan_skip_or_disable()

[Paulo Alcantara]

Wentao Liang <vulab at iscas.ac.cn> writes:

> When a secondary channel is no longer supported by the server,
> cifs_chan_skip_or_disable() drops the channel reference with
> cifs_put_tcp_session() and then continues to use the server pointer by
> calling cifs_signal_cifsd_for_reconnect() on it and reading its
> primary_server pointer. cifs_put_tcp_session() can drop the last
> reference of the channel and tear it down, so both the channel and the
> primary server (whose reference is also dropped by
> cifs_put_tcp_session()) can be freed before they are signaled for
> reconnect.
>
> Signal the channel and the primary server and capture the primary
> server pointer before dropping the channel reference with
> cifs_put_tcp_session().
> ...

Applied.