iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs/cifs
History
Paulo Alcantara da407a0029 cifs: fix potential use-after-free in cifs_echo_request() 
commit 212253367dc7b49ed3fc194ce71b0992eacaecf2 upstream.

This patch fixes a potential use-after-free bug in
cifs_echo_request().

For instance,

  thread 1
  --------
  cifs_demultiplex_thread()
    clean_demultiplex_info()
      kfree(server)

  thread 2 (workqueue)
  --------
  apic_timer_interrupt()
    smp_apic_timer_interrupt()
      irq_exit()
        __do_softirq()
          run_timer_softirq()
            call_timer_fn()
	      cifs_echo_request() <- use-after-free in server ptr

Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
CC: Stable <stable@vger.kernel.org>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:38:00 +01:00
..
asn1.c
cifs: remove bogus debug code
2020-10-29 09:05:32 +01:00
cache.c
…
cifs_debug.c
smb3: allow stats which track session and share reconnects to be reset
2018-11-13 11:17:01 -08:00
cifs_debug.h
lib: update single-char callers of strtobool()
2016-03-17 15:09:34 -07:00
cifs_dfs_ref.c
cifs: use correct format characters
2019-04-05 22:29:07 +02:00
cifs_fs_sb.h
CIFS: Add new mount option to set owner uid and gid from special sids in acl
2016-10-14 14:22:01 -05:00
cifs_ioctl.h
Enable previous version support
2016-10-13 19:48:11 -05:00
cifs_spnego.c
smb3: on kerberos mount if server doesn't specify auth type use krb5
2018-11-13 11:17:01 -08:00
cifs_spnego.h
…
cifs_unicode.c
Convert trailing spaces and periods in path components
2020-11-18 18:26:32 +01:00
cifs_unicode.h
CIFS: add misssing SFM mapping for doublequote
2017-05-20 14:28:40 +02:00
cifs_uniupr.h
…
cifsacl.c
cifs: Fix mode output in debugging statements
2020-03-11 07:53:04 +01:00
cifsacl.h
…
cifsencrypt.c
CIFS: zero sensitive data when freeing
2018-02-17 13:21:12 +01:00
cifsfs.c
cifs: don't dereference smb_file_target before null check
2018-11-27 16:09:37 +01:00
cifsfs.h
cifs: don't use ->d_time
2016-09-16 12:44:21 +02:00
cifsglob.h
CIFS: Properly process SMB3 lease breaks
2020-10-01 20:40:04 +02:00
cifspdu.h
Add way to query server fs info for smb3
2015-08-20 10:19:25 -05:00
cifsproto.h
cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs
2019-11-10 11:23:21 +01:00
cifssmb.c
cifs: Check for timeout on Negotiate stage
2020-05-20 08:15:34 +02:00
connect.c
cifs: fix potential use-after-free in cifs_echo_request()
2020-12-11 13:38:00 +01:00
dir.c
cifs_atomic_open(): fix double-put on late allocation failure
2020-03-20 09:07:44 +01:00
dns_resolve.c
…
dns_resolve.h
…
export.c
…
file.c
cifs: Fix double add page to memcg when cifs_readpages
2020-10-01 20:40:15 +02:00
fscache.c
…
fscache.h
…
inode.c
Revert "cifs: Fix the target file was deleted when rename failed."
2020-07-31 16:44:04 +02:00
ioctl.c
cifs: fix CIFS_IOC_GET_MNT_INFO oops
2017-05-20 14:28:40 +02:00
Kconfig
Revert "cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)"
2019-02-15 08:07:39 +01:00
link.c
smb3: don't request leases in symlink creation and query
2018-09-05 09:20:05 +02:00
Makefile
cifs: Switch to generic xattr handlers
2016-04-23 15:33:03 -04:00
misc.c
CIFS: Properly process SMB3 lease breaks
2020-10-01 20:40:04 +02:00
netmisc.c
fs: cifs: mute -Wunused-const-variable message
2019-11-06 12:18:08 +01:00
nterr.c
…
nterr.h
…
ntlmssp.h
cifs: dynamic allocation of ntlmssp blob
2016-06-23 23:45:07 -05:00
readdir.c
cifs: check ntwrk_buf_start for NULL before dereferencing it
2019-02-12 19:44:58 +01:00
rfc1002pdu.h
…
sess.c
cifs: check kmalloc before use
2018-09-05 09:20:05 +02:00
smb1ops.c
CIFS: Properly process SMB3 lease breaks
2020-10-01 20:40:04 +02:00
smb2file.c
cifs: Adjust indentation in smb2_open_file
2020-01-23 08:19:35 +01:00
smb2glob.h
SMB3: Add mount parameter to allow user to override max credits
2016-10-12 12:08:33 -05:00
smb2inode.c
smb3: Do not send SMB3 SET_INFO if nothing changed
2018-09-05 09:20:05 +02:00
smb2maperror.c
fix incorrect error code mapping for OBJECTID_NOT_FOUND
2019-04-20 09:07:50 +02:00
smb2misc.c
CIFS: Properly process SMB3 lease breaks
2020-10-01 20:40:04 +02:00
smb2ops.c
CIFS: Properly process SMB3 lease breaks
2020-10-01 20:40:04 +02:00
smb2pdu.c
smb3: warn on confusing error scenario with sec=krb5
2020-08-21 11:02:06 +02:00
smb2pdu.h
CIFS: Properly process SMB3 lease breaks
2020-10-01 20:40:04 +02:00
smb2proto.h
Handle mismatched open calls
2017-05-08 07:47:55 +02:00
smb2status.h
…
smb2transport.c
Handle mismatched open calls
2017-05-08 07:47:55 +02:00
smbencrypt.c
cifs: Fix smbencrypt() to stop pointing a scatterlist at the stack
2017-01-06 10:40:16 +01:00
smberr.h
…
smbfsctl.h
[SMB3] Send durable handle v2 contexts when use of persistent handles required
2015-11-03 09:26:27 -06:00
transport.c
CIFS: Do not hide EINTR after sending network packets
2019-01-16 22:12:31 +01:00
winucase.c
…
xattr.c
CIFS: fix max ea value size
2019-10-05 12:30:36 +02:00