mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 09:19:51 +00:00
396935de14
The UAF bug occurred because we were putting DFS root sessions in cifs_umount() while DFS cache refresher was being executed. Make DFS root sessions have same lifetime as DFS tcons so we can avoid the use-after-free bug is DFS cache refresher and other places that require IPCs to get new DFS referrals on. Also, get rid of mount group handling in DFS cache as we no longer need it. This fixes below use-after-free bug catched by KASAN [ 379.946955] BUG: KASAN: use-after-free in __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.947642] Read of size 8 at addr ffff888018f57030 by task kworker/u4:3/56 [ 379.948096] [ 379.948208] CPU: 0 PID: 56 Comm: kworker/u4:3 Not tainted 6.2.0-rc7-lku #23 [ 379.948661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014 [ 379.949368] Workqueue: cifs-dfscache refresh_cache_worker [cifs] [ 379.949942] Call Trace: [ 379.950113] <TASK> [ 379.950260] dump_stack_lvl+0x50/0x67 [ 379.950510] print_report+0x16a/0x48e [ 379.950759] ? __virt_addr_valid+0xd8/0x160 [ 379.951040] ? __phys_addr+0x41/0x80 [ 379.951285] kasan_report+0xdb/0x110 [ 379.951533] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.952056] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.952585] __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.953096] ? __pfx___refresh_tcon.isra.0+0x10/0x10 [cifs] [ 379.953637] ? __pfx___mutex_lock+0x10/0x10 [ 379.953915] ? lock_release+0xb6/0x720 [ 379.954167] ? __pfx_lock_acquire+0x10/0x10 [ 379.954443] ? refresh_cache_worker+0x34e/0x6d0 [cifs] [ 379.954960] ? __pfx_wb_workfn+0x10/0x10 [ 379.955239] refresh_cache_worker+0x4ad/0x6d0 [cifs] [ 379.955755] ? __pfx_refresh_cache_worker+0x10/0x10 [cifs] [ 379.956323] ? __pfx_lock_acquired+0x10/0x10 [ 379.956615] ? read_word_at_a_time+0xe/0x20 [ 379.956898] ? lockdep_hardirqs_on_prepare+0x12/0x220 [ 379.957235] process_one_work+0x535/0x990 [ 379.957509] ? __pfx_process_one_work+0x10/0x10 [ 379.957812] ? lock_acquired+0xb7/0x5f0 [ 379.958069] ? __list_add_valid+0x37/0xd0 [ 379.958341] ? __list_add_valid+0x37/0xd0 [ 379.958611] worker_thread+0x8e/0x630 [ 379.958861] ? __pfx_worker_thread+0x10/0x10 [ 379.959148] kthread+0x17d/0x1b0 [ 379.959369] ? __pfx_kthread+0x10/0x10 [ 379.959630] ret_from_fork+0x2c/0x50 [ 379.959879] </TASK> Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com> Cc: stable@vger.kernel.org # 6.2 Signed-off-by: Steve French <stfrench@microsoft.com>
74 lines
3.3 KiB
C
74 lines
3.3 KiB
C
/* SPDX-License-Identifier: LGPL-2.1 */
|
|
/*
|
|
*
|
|
* Copyright (c) International Business Machines Corp., 2002,2004
|
|
* Author(s): Steve French (sfrench@us.ibm.com)
|
|
*
|
|
*/
|
|
#include <linux/rbtree.h>
|
|
|
|
#ifndef _CIFS_FS_SB_H
|
|
#define _CIFS_FS_SB_H
|
|
|
|
#include <linux/backing-dev.h>
|
|
|
|
#define CIFS_MOUNT_NO_PERM 1 /* do not do client vfs_perm check */
|
|
#define CIFS_MOUNT_SET_UID 2 /* set current's euid in create etc. */
|
|
#define CIFS_MOUNT_SERVER_INUM 4 /* inode numbers from uniqueid from server */
|
|
#define CIFS_MOUNT_DIRECT_IO 8 /* do not write nor read through page cache */
|
|
#define CIFS_MOUNT_NO_XATTR 0x10 /* if set - disable xattr support */
|
|
#define CIFS_MOUNT_MAP_SPECIAL_CHR 0x20 /* remap illegal chars in filenames */
|
|
#define CIFS_MOUNT_POSIX_PATHS 0x40 /* Negotiate posix pathnames if possible*/
|
|
#define CIFS_MOUNT_UNX_EMUL 0x80 /* Network compat with SFUnix emulation */
|
|
#define CIFS_MOUNT_NO_BRL 0x100 /* No sending byte range locks to srv */
|
|
#define CIFS_MOUNT_CIFS_ACL 0x200 /* send ACL requests to non-POSIX srv */
|
|
#define CIFS_MOUNT_OVERR_UID 0x400 /* override uid returned from server */
|
|
#define CIFS_MOUNT_OVERR_GID 0x800 /* override gid returned from server */
|
|
#define CIFS_MOUNT_DYNPERM 0x1000 /* allow in-memory only mode setting */
|
|
#define CIFS_MOUNT_NOPOSIXBRL 0x2000 /* mandatory not posix byte range lock */
|
|
#define CIFS_MOUNT_NOSSYNC 0x4000 /* don't do slow SMBflush on every sync*/
|
|
#define CIFS_MOUNT_FSCACHE 0x8000 /* local caching enabled */
|
|
#define CIFS_MOUNT_MF_SYMLINKS 0x10000 /* Minshall+French Symlinks enabled */
|
|
#define CIFS_MOUNT_MULTIUSER 0x20000 /* multiuser mount */
|
|
#define CIFS_MOUNT_STRICT_IO 0x40000 /* strict cache mode */
|
|
#define CIFS_MOUNT_RWPIDFORWARD 0x80000 /* use pid forwarding for rw */
|
|
#define CIFS_MOUNT_POSIXACL 0x100000 /* mirror of SB_POSIXACL in mnt_cifs_flags */
|
|
#define CIFS_MOUNT_CIFS_BACKUPUID 0x200000 /* backup intent bit for a user */
|
|
#define CIFS_MOUNT_CIFS_BACKUPGID 0x400000 /* backup intent bit for a group */
|
|
#define CIFS_MOUNT_MAP_SFM_CHR 0x800000 /* SFM/MAC mapping for illegal chars */
|
|
#define CIFS_MOUNT_USE_PREFIX_PATH 0x1000000 /* make subpath with unaccessible
|
|
* root mountable
|
|
*/
|
|
#define CIFS_MOUNT_UID_FROM_ACL 0x2000000 /* try to get UID via special SID */
|
|
#define CIFS_MOUNT_NO_HANDLE_CACHE 0x4000000 /* disable caching dir handles */
|
|
#define CIFS_MOUNT_NO_DFS 0x8000000 /* disable DFS resolving */
|
|
#define CIFS_MOUNT_MODE_FROM_SID 0x10000000 /* retrieve mode from special ACE */
|
|
#define CIFS_MOUNT_RO_CACHE 0x20000000 /* assumes share will not change */
|
|
#define CIFS_MOUNT_RW_CACHE 0x40000000 /* assumes only client accessing */
|
|
#define CIFS_MOUNT_SHUTDOWN 0x80000000
|
|
|
|
struct cifs_sb_info {
|
|
struct rb_root tlink_tree;
|
|
spinlock_t tlink_tree_lock;
|
|
struct tcon_link *master_tlink;
|
|
struct nls_table *local_nls;
|
|
struct smb3_fs_context *ctx;
|
|
atomic_t active;
|
|
unsigned int mnt_cifs_flags;
|
|
struct delayed_work prune_tlinks;
|
|
struct rcu_head rcu;
|
|
|
|
/* only used when CIFS_MOUNT_USE_PREFIX_PATH is set */
|
|
char *prepath;
|
|
|
|
/*
|
|
* Indicate whether serverino option was turned off later
|
|
* (cifs_autodisable_serverino) in order to match new mounts.
|
|
*/
|
|
bool mnt_cifs_serverino_autodisabled;
|
|
/*
|
|
* Available once the mount has completed.
|
|
*/
|
|
struct dentry *root;
|
|
};
|
|
#endif /* _CIFS_FS_SB_H */
|