CVE-2024-42256

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix server re-repick on subrequest retry

When a subrequest is marked for needing retry, netfs will call

cifs_prepare_write() which will make cifs repick the server for the op

before renegotiating credits; it then calls cifs_issue_write() which

invokes smb2_async_writev() - which re-repicks the server.

If a different server is then selected, this causes the increment of

server->in_flight to happen against one record and the decrement to happen

against another, leading to misaccounting.

Fix this by just removing the repick code in smb2_async_writev(). As this

is only called from netfslib-driven code, cifs_prepare_write() should

always have been called first, and so server should never be NULL and the

preparatory step is repeated in the event that we do a retry.

The problem manifests as a warning looking something like:

WARNING: CPU: 4 PID: 72896 at fs/smb/client/smb2ops.c:97 smb2_add_credits+0x3f0/0x9e0 [ci

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References