ksmbd: fix potential UAF

After calling opinfo_put(), the opinfo may be freed, then using this
opinfo in the next traversal will cause UAF bug.

To fix it, swap the call order of opinfo_put() and rcu_read_lock(), so
that the opinfo_free_rcu() will not be called, and the opinfo will not be
freed, then we can safely perform the next traversal.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: Qi Zheng <[email protected]>
Signed-off-by: Namjae Jeon <[email protected]>

oplock.c

@@ -1233,8 +1233,8 @@ int find_same_lease_key(struct ksmbd_session *sess, struct ksmbd_inode *ci,
 			goto out;
 		}
 op_next:
-		opinfo_put(opinfo);
 		rcu_read_lock();
+		opinfo_put(opinfo);
 	}
 	rcu_read_unlock();
 
@@ -1561,8 +1561,8 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp,
 		brk_op->open_trunc = is_trunc;
 		oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE);
 next:
-		opinfo_conn_put(brk_op);
 		rcu_read_lock();
+		opinfo_conn_put(brk_op);
 	}
 	rcu_read_unlock();
 
@@ -1986,8 +1986,8 @@ struct oplock_info *lookup_lease_in_table(struct ksmbd_conn *conn,
 			goto out;
 		}
 op_next:
-		opinfo_put(opinfo);
 		rcu_read_lock();
+		opinfo_put(opinfo);
 	}
 	rcu_read_unlock();