cifs: Possible slab memory corruption while updating extended stats (repost)

Updating extended statistics here can cause slab memory corruption
if a callback function frees slab memory (mid_entry).

Signed-off-by: Shirish Pargaonkar <[email protected]>
Reviewed-by: Jeff Layton <[email protected]>
Signed-off-by: Steve French <[email protected]>

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 945b2202275fc69e4080d7ebd6a9f4d70cc00724..1f32a2893b5f14d9225861b099cb0fd6e5860d14 100644 (file)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -633,11 +633,11 @@ incomplete_rcv:
                                mid_entry->largeBuf = isLargeBuf;
 multi_t2_fnd:
                                mid_entry->midState = MID_RESPONSE_RECEIVED;
-                               list_del_init(&mid_entry->qhead);
-                               mid_entry->callback(mid_entry);
 #ifdef CONFIG_CIFS_STATS2
                                mid_entry->when_received = jiffies;
 #endif
+                               list_del_init(&mid_entry->qhead);
+                               mid_entry->callback(mid_entry);
                                break;
                        }
                        mid_entry = NULL;