iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
e3ea75ee65
linux/fs/cifs
History
ChenXiaoSong 542228db2f cifs: fix use-after-free on the link name 
xfstests generic/011 reported use-after-free bug as follows:

  BUG: KASAN: use-after-free in __d_alloc+0x269/0x859
  Read of size 15 at addr ffff8880078933a0 by task dirstress/952

  CPU: 1 PID: 952 Comm: dirstress Not tainted 6.1.0-rc3+ #77
  Call Trace:
   __dump_stack+0x23/0x29
   dump_stack_lvl+0x51/0x73
   print_address_description+0x67/0x27f
   print_report+0x3e/0x5c
   kasan_report+0x7b/0xa8
   kasan_check_range+0x1b2/0x1c1
   memcpy+0x22/0x5d
   __d_alloc+0x269/0x859
   d_alloc+0x45/0x20c
   d_alloc_parallel+0xb2/0x8b2
   lookup_open+0x3b8/0x9f9
   open_last_lookups+0x63d/0xc26
   path_openat+0x11a/0x261
   do_filp_open+0xcc/0x168
   do_sys_openat2+0x13b/0x3f7
   do_sys_open+0x10f/0x146
   __se_sys_creat+0x27/0x2e
   __x64_sys_creat+0x55/0x6a
   do_syscall_64+0x40/0x96
   entry_SYSCALL_64_after_hwframe+0x63/0xcd

  Allocated by task 952:
   kasan_save_stack+0x1f/0x42
   kasan_set_track+0x21/0x2a
   kasan_save_alloc_info+0x17/0x1d
   __kasan_kmalloc+0x7e/0x87
   __kmalloc_node_track_caller+0x59/0x155
   kstrndup+0x60/0xe6
   parse_mf_symlink+0x215/0x30b
   check_mf_symlink+0x260/0x36a
   cifs_get_inode_info+0x14e1/0x1690
   cifs_revalidate_dentry_attr+0x70d/0x964
   cifs_revalidate_dentry+0x36/0x62
   cifs_d_revalidate+0x162/0x446
   lookup_open+0x36f/0x9f9
   open_last_lookups+0x63d/0xc26
   path_openat+0x11a/0x261
   do_filp_open+0xcc/0x168
   do_sys_openat2+0x13b/0x3f7
   do_sys_open+0x10f/0x146
   __se_sys_creat+0x27/0x2e
   __x64_sys_creat+0x55/0x6a
   do_syscall_64+0x40/0x96
   entry_SYSCALL_64_after_hwframe+0x63/0xcd

  Freed by task 950:
   kasan_save_stack+0x1f/0x42
   kasan_set_track+0x21/0x2a
   kasan_save_free_info+0x1c/0x34
   ____kasan_slab_free+0x1c1/0x1d5
   __kasan_slab_free+0xe/0x13
   __kmem_cache_free+0x29a/0x387
   kfree+0xd3/0x10e
   cifs_fattr_to_inode+0xb6a/0xc8c
   cifs_get_inode_info+0x3cb/0x1690
   cifs_revalidate_dentry_attr+0x70d/0x964
   cifs_revalidate_dentry+0x36/0x62
   cifs_d_revalidate+0x162/0x446
   lookup_open+0x36f/0x9f9
   open_last_lookups+0x63d/0xc26
   path_openat+0x11a/0x261
   do_filp_open+0xcc/0x168
   do_sys_openat2+0x13b/0x3f7
   do_sys_open+0x10f/0x146
   __se_sys_creat+0x27/0x2e
   __x64_sys_creat+0x55/0x6a
   do_syscall_64+0x40/0x96
   entry_SYSCALL_64_after_hwframe+0x63/0xcd

When opened a symlink, link name is from 'inode->i_link', but it may be
reset to a new value when revalidate the dentry. If some processes get the
link name on the race scenario, then UAF will happen on link name.

Fix this by implementing 'get_link' interface to duplicate the link name.

Fixes: 76894f3e2f ("cifs: improve symlink handling for smb2+")
Signed-off-by: ChenXiaoSong <chenxiaosong2@huawei.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Steve French <stfrench@microsoft.com>
2022-11-04 23:36:54 -05:00
..
asn1.c cifs: decoding negTokenInit with generic ASN1 decoder 2021-06-20 21:28:17 -05:00
cached_dir.c cifs: drop the lease for cached directories on rmdir or rename 2022-10-19 17:57:41 -05:00
cached_dir.h cifs: drop the lease for cached directories on rmdir or rename 2022-10-19 17:57:41 -05:00
cifs_debug.c smb3: add dynamic trace points for tree disconnect 2022-10-05 01:31:18 -05:00
cifs_debug.h smb3: add dynamic trace points for tree disconnect 2022-10-05 01:31:18 -05:00
cifs_dfs_ref.c cifs: support nested dfs links over reconnect 2021-11-10 16:30:13 -06:00
cifs_fs_sb.h cifs: support nested dfs links over reconnect 2021-11-10 16:30:13 -06:00
cifs_ioctl.h smb3: improve SMB3 change notification support 2022-10-15 10:05:53 -05:00
cifs_spnego_negtokeninit.asn1 cifs: decoding negTokenInit with generic ASN1 decoder 2021-06-20 21:28:17 -05:00
cifs_spnego.c cifs: use the chans_need_reconnect bitmap for reconnect status 2022-01-02 20:38:46 -06:00
cifs_spnego.h cifs: use the chans_need_reconnect bitmap for reconnect status 2022-01-02 20:38:46 -06:00
cifs_swn.c smb3: add dynamic trace points for tree disconnect 2022-10-05 01:31:18 -05:00
cifs_swn.h cifs: simplify SWN code with dummy funcs instead of ifdefs 2021-04-25 16:28:22 -05:00
cifs_unicode.c cifs: remove pathname for file from SPDX header 2021-09-13 14:51:10 -05:00
cifs_unicode.h
cifs_uniupr.h
cifsacl.c cifs: when insecure legacy is disabled shrink amount of SMB1 code 2022-08-05 11:24:03 -05:00
cifsacl.h cifs: remove pathname for file from SPDX header 2021-09-13 14:51:10 -05:00
cifsencrypt.c cifs: secmech: use shash_desc directly, remove sdesc 2022-10-07 23:08:39 -05:00
cifsfs.c cifs: fix use-after-free on the link name 2022-11-04 23:36:54 -05:00
cifsfs.h cifs: update internal module number 2022-10-19 17:57:51 -05:00
cifsglob.h smb3: improve SMB3 change notification support 2022-10-15 10:05:53 -05:00
cifspdu.h cifs: Replace a couple of one-element arrays with flexible-array members 2022-10-05 17:42:38 -05:00
cifsproto.h cifs: improve symlink handling for smb2+ 2022-10-13 09:36:04 -05:00
cifsroot.c cifs: move from strlcpy with unused retval to strscpy 2022-08-19 11:02:26 -05:00
cifssmb.c cifs: use ALIGN() and round_up() macros 2022-10-13 09:36:39 -05:00
connect.c cifs: fix use-after-free caused by invalid pointer hostname 2022-10-27 23:59:13 -05:00
dfs_cache.c smb3: add dynamic trace points for tree disconnect 2022-10-05 01:31:18 -05:00
dfs_cache.h cifs: support share failover when remounting 2021-07-22 11:43:23 -05:00
dir.c cifs: Fix xid leak in cifs_create() 2022-10-18 11:33:43 -05:00
dns_resolve.c cifs: remove pathname for file from SPDX header 2021-09-13 14:51:10 -05:00
dns_resolve.h cifs: remove pathname for file from SPDX header 2021-09-13 14:51:10 -05:00
export.c cifs: remove pathname for file from SPDX header 2021-09-13 14:51:10 -05:00
file.c cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() 2022-10-23 17:50:10 -05:00
fs_context.c cifs: replace kfree() with kfree_sensitive() for sensitive data 2022-10-07 23:06:48 -05:00
fs_context.h smb3: allow deferred close timeout to be configurable 2022-08-11 20:03:04 -05:00
fscache.c smb3: add dynamic trace points for tree disconnect 2022-10-05 01:31:18 -05:00
fscache.h cifs: Remove {cifs,nfs}_fscache_release_page() 2022-08-10 21:26:08 -05:00
inode.c cifs: fix use-after-free on the link name 2022-11-04 23:36:54 -05:00
ioctl.c smb3: improve SMB3 change notification support 2022-10-15 10:05:53 -05:00
Kconfig cifs: Support fscache indexing rewrite 2022-01-19 11:21:08 -06:00
link.c cifs: improve symlink handling for smb2+ 2022-10-13 09:36:04 -05:00
Makefile cifs: Move cached-dir functions into a separate file 2022-08-11 10:33:18 -05:00
misc.c cifs: always iterate smb sessions using primary channel 2022-11-04 23:34:02 -05:00
netlink.c genetlink: start to validate reserved header bytes 2022-08-29 12:47:15 +01:00
netlink.h cifs: Register generic netlink family 2020-12-14 09:16:22 -06:00
netmisc.c cifs: remove unused server parameter from calc_smb_size() 2022-08-17 18:07:13 -05:00
nterr.c
nterr.h
ntlmssp.h treewide: Replace zero-length arrays with flexible-array members 2022-02-17 07:00:39 -06:00
readdir.c cifs: improve symlink handling for smb2+ 2022-10-13 09:36:04 -05:00
rfc1002pdu.h cifs: remove pathname for file from SPDX header 2021-09-13 14:51:10 -05:00
sess.c cifs: Fix xid leak in cifs_ses_add_channel() 2022-10-18 11:33:43 -05:00
smb1ops.c cifs: improve symlink handling for smb2+ 2022-10-13 09:36:04 -05:00
smb2file.c cifs: fix static checker warning 2022-10-14 12:35:25 -05:00
smb2glob.h smb3: move defines for ioctl protocol header and SMB2 sizes to smbfs_common 2022-03-26 23:09:20 -05:00
smb2inode.c cifs: drop the lease for cached directories on rmdir or rename 2022-10-19 17:57:41 -05:00
smb2maperror.c cifs: Create a new shared file holding smb2 pdu definitions 2021-11-05 09:50:57 -05:00
smb2misc.c cifs: avoid unnecessary iteration of tcp sessions 2022-11-04 23:34:40 -05:00
smb2ops.c cifs: avoid unnecessary iteration of tcp sessions 2022-11-04 23:34:40 -05:00
smb2pdu.c cifs: fix memory leaks in session setup 2022-10-19 17:57:51 -05:00
smb2pdu.h cifs: improve symlink handling for smb2+ 2022-10-13 09:36:04 -05:00
smb2proto.h smb3: improve SMB3 change notification support 2022-10-15 10:05:53 -05:00
smb2status.h cifs: remove pathname for file from SPDX header 2021-09-13 14:51:10 -05:00
smb2transport.c cifs: avoid unnecessary iteration of tcp sessions 2022-11-04 23:34:40 -05:00
smbdirect.c Fix formatting of client smbdirect RDMA logging 2022-10-05 01:31:04 -05:00
smbdirect.h Decrease the number of SMB3 smbdirect client SGEs 2022-10-05 01:29:21 -05:00
smbencrypt.c cifs: rename cifs_common to smbfs_common 2021-09-08 23:59:26 -05:00
smberr.h cifs: remove pathname for file from SPDX header 2021-09-13 14:51:10 -05:00
trace.c
trace.h smb3: add dynamic trace points for tree disconnect 2022-10-05 01:31:18 -05:00
transport.c Scheduler changes for v6.1: 2022-10-10 09:10:28 -07:00
unc.c cifs: don't cargo-cult strndup() 2021-04-25 16:28:23 -05:00
winucase.c cifs: remove pathname for file from SPDX header 2021-09-13 14:51:10 -05:00
xattr.c cifs: when insecure legacy is disabled shrink amount of SMB1 code 2022-08-05 11:24:03 -05:00