mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 17:30:02 +00:00
![Paulo Alcantara](/assets/img/avatar_default.png)
The UAF bug occurred because we were putting DFS root sessions in cifs_umount() while DFS cache refresher was being executed. Make DFS root sessions have same lifetime as DFS tcons so we can avoid the use-after-free bug is DFS cache refresher and other places that require IPCs to get new DFS referrals on. Also, get rid of mount group handling in DFS cache as we no longer need it. This fixes below use-after-free bug catched by KASAN [ 379.946955] BUG: KASAN: use-after-free in __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.947642] Read of size 8 at addr ffff888018f57030 by task kworker/u4:3/56 [ 379.948096] [ 379.948208] CPU: 0 PID: 56 Comm: kworker/u4:3 Not tainted 6.2.0-rc7-lku #23 [ 379.948661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014 [ 379.949368] Workqueue: cifs-dfscache refresh_cache_worker [cifs] [ 379.949942] Call Trace: [ 379.950113] <TASK> [ 379.950260] dump_stack_lvl+0x50/0x67 [ 379.950510] print_report+0x16a/0x48e [ 379.950759] ? __virt_addr_valid+0xd8/0x160 [ 379.951040] ? __phys_addr+0x41/0x80 [ 379.951285] kasan_report+0xdb/0x110 [ 379.951533] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.952056] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.952585] __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.953096] ? __pfx___refresh_tcon.isra.0+0x10/0x10 [cifs] [ 379.953637] ? __pfx___mutex_lock+0x10/0x10 [ 379.953915] ? lock_release+0xb6/0x720 [ 379.954167] ? __pfx_lock_acquire+0x10/0x10 [ 379.954443] ? refresh_cache_worker+0x34e/0x6d0 [cifs] [ 379.954960] ? __pfx_wb_workfn+0x10/0x10 [ 379.955239] refresh_cache_worker+0x4ad/0x6d0 [cifs] [ 379.955755] ? __pfx_refresh_cache_worker+0x10/0x10 [cifs] [ 379.956323] ? __pfx_lock_acquired+0x10/0x10 [ 379.956615] ? read_word_at_a_time+0xe/0x20 [ 379.956898] ? lockdep_hardirqs_on_prepare+0x12/0x220 [ 379.957235] process_one_work+0x535/0x990 [ 379.957509] ? __pfx_process_one_work+0x10/0x10 [ 379.957812] ? lock_acquired+0xb7/0x5f0 [ 379.958069] ? __list_add_valid+0x37/0xd0 [ 379.958341] ? __list_add_valid+0x37/0xd0 [ 379.958611] worker_thread+0x8e/0x630 [ 379.958861] ? __pfx_worker_thread+0x10/0x10 [ 379.959148] kthread+0x17d/0x1b0 [ 379.959369] ? __pfx_kthread+0x10/0x10 [ 379.959630] ret_from_fork+0x2c/0x50 [ 379.959879] </TASK> Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com> Cc: stable@vger.kernel.org # 6.2 Signed-off-by: Steve French <stfrench@microsoft.com>
92 lines
2.5 KiB
C
92 lines
2.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* DFS referral cache routines
|
|
*
|
|
* Copyright (c) 2018-2019 Paulo Alcantara <palcantara@suse.de>
|
|
*/
|
|
|
|
#ifndef _CIFS_DFS_CACHE_H
|
|
#define _CIFS_DFS_CACHE_H
|
|
|
|
#include <linux/nls.h>
|
|
#include <linux/list.h>
|
|
#include <linux/uuid.h>
|
|
#include "cifsglob.h"
|
|
|
|
#define DFS_CACHE_TGT_LIST_INIT(var) { .tl_numtgts = 0, .tl_list = LIST_HEAD_INIT((var).tl_list), }
|
|
|
|
struct dfs_cache_tgt_list {
|
|
int tl_numtgts;
|
|
struct list_head tl_list;
|
|
};
|
|
|
|
struct dfs_cache_tgt_iterator {
|
|
char *it_name;
|
|
int it_path_consumed;
|
|
struct list_head it_list;
|
|
};
|
|
|
|
int dfs_cache_init(void);
|
|
void dfs_cache_destroy(void);
|
|
extern const struct proc_ops dfscache_proc_ops;
|
|
|
|
int dfs_cache_find(const unsigned int xid, struct cifs_ses *ses, const struct nls_table *cp,
|
|
int remap, const char *path, struct dfs_info3_param *ref,
|
|
struct dfs_cache_tgt_list *tgt_list);
|
|
int dfs_cache_noreq_find(const char *path, struct dfs_info3_param *ref,
|
|
struct dfs_cache_tgt_list *tgt_list);
|
|
void dfs_cache_noreq_update_tgthint(const char *path, const struct dfs_cache_tgt_iterator *it);
|
|
int dfs_cache_get_tgt_referral(const char *path, const struct dfs_cache_tgt_iterator *it,
|
|
struct dfs_info3_param *ref);
|
|
int dfs_cache_get_tgt_share(char *path, const struct dfs_cache_tgt_iterator *it, char **share,
|
|
char **prefix);
|
|
char *dfs_cache_canonical_path(const char *path, const struct nls_table *cp, int remap);
|
|
int dfs_cache_remount_fs(struct cifs_sb_info *cifs_sb);
|
|
|
|
static inline struct dfs_cache_tgt_iterator *
|
|
dfs_cache_get_next_tgt(struct dfs_cache_tgt_list *tl,
|
|
struct dfs_cache_tgt_iterator *it)
|
|
{
|
|
if (!tl || list_empty(&tl->tl_list) || !it ||
|
|
list_is_last(&it->it_list, &tl->tl_list))
|
|
return NULL;
|
|
return list_next_entry(it, it_list);
|
|
}
|
|
|
|
static inline struct dfs_cache_tgt_iterator *
|
|
dfs_cache_get_tgt_iterator(struct dfs_cache_tgt_list *tl)
|
|
{
|
|
if (!tl)
|
|
return NULL;
|
|
return list_first_entry_or_null(&tl->tl_list,
|
|
struct dfs_cache_tgt_iterator,
|
|
it_list);
|
|
}
|
|
|
|
static inline void dfs_cache_free_tgts(struct dfs_cache_tgt_list *tl)
|
|
{
|
|
struct dfs_cache_tgt_iterator *it, *nit;
|
|
|
|
if (!tl || list_empty(&tl->tl_list))
|
|
return;
|
|
list_for_each_entry_safe(it, nit, &tl->tl_list, it_list) {
|
|
list_del(&it->it_list);
|
|
kfree(it->it_name);
|
|
kfree(it);
|
|
}
|
|
tl->tl_numtgts = 0;
|
|
}
|
|
|
|
static inline const char *
|
|
dfs_cache_get_tgt_name(const struct dfs_cache_tgt_iterator *it)
|
|
{
|
|
return it ? it->it_name : NULL;
|
|
}
|
|
|
|
static inline int
|
|
dfs_cache_get_nr_tgts(const struct dfs_cache_tgt_list *tl)
|
|
{
|
|
return tl ? tl->tl_numtgts : 0;
|
|
}
|
|
|
|
#endif /* _CIFS_DFS_CACHE_H */
|