Paulo Alcantara (SUSE) 42e8507bf2 cifs: Fix use-after-free bug in cifs_reconnect() ... [ Upstream commit 8354d88efd ] Ensure we grab an active reference in cifs superblock while doing failover to prevent automounts (DFS links) of expiring and then destroying the superblock pointer. This patch fixes the following KASAN report: [ 464.301462] BUG: KASAN: use-after-free in cifs_reconnect+0x6ab/0x1350 [ 464.303052] Read of size 8 at addr ffff888155e580d0 by task cifsd/1107 [ 464.304682] CPU: 3 PID: 1107 Comm: cifsd Not tainted 5.4.0-rc4+ #13 [ 464.305552] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58-rebuilt.opensuse.org 04/01/2014 [ 464.307146] Call Trace: [ 464.307875] dump_stack+0x5b/0x90 [ 464.308631] print_address_description.constprop.0+0x16/0x200 [ 464.309478] ? cifs_reconnect+0x6ab/0x1350 [ 464.310253] ? cifs_reconnect+0x6ab/0x1350 [ 464.311040] __kasan_report.cold+0x1a/0x41 [ 464.311811] ? cifs_reconnect+0x6ab/0x1350 [ 464.312563] kasan_report+0xe/0x20 [ 464.313300] cifs_reconnect+0x6ab/0x1350 [ 464.314062] ? extract_hostname.part.0+0x90/0x90 [ 464.314829] ? printk+0xad/0xde [ 464.315525] ? _raw_spin_lock+0x7c/0xd0 [ 464.316252] ? _raw_read_lock_irq+0x40/0x40 [ 464.316961] ? ___ratelimit+0xed/0x182 [ 464.317655] cifs_readv_from_socket+0x289/0x3b0 [ 464.318386] cifs_read_from_socket+0x98/0xd0 [ 464.319078] ? cifs_readv_from_socket+0x3b0/0x3b0 [ 464.319782] ? try_to_wake_up+0x43c/0xa90 [ 464.320463] ? cifs_small_buf_get+0x4b/0x60 [ 464.321173] ? allocate_buffers+0x98/0x1a0 [ 464.321856] cifs_demultiplex_thread+0x218/0x14a0 [ 464.322558] ? cifs_handle_standard+0x270/0x270 [ 464.323237] ? __switch_to_asm+0x40/0x70 [ 464.323893] ? __switch_to_asm+0x34/0x70 [ 464.324554] ? __switch_to_asm+0x40/0x70 [ 464.325226] ? __switch_to_asm+0x40/0x70 [ 464.325863] ? __switch_to_asm+0x34/0x70 [ 464.326505] ? __switch_to_asm+0x40/0x70 [ 464.327161] ? __switch_to_asm+0x34/0x70 [ 464.327784] ? finish_task_switch+0xa1/0x330 [ 464.328414] ? __switch_to+0x363/0x640 [ 464.329044] ? __schedule+0x575/0xaf0 [ 464.329655] ? _raw_spin_lock_irqsave+0x82/0xe0 [ 464.330301] kthread+0x1a3/0x1f0 [ 464.330884] ? cifs_handle_standard+0x270/0x270 [ 464.331624] ? kthread_create_on_node+0xd0/0xd0 [ 464.332347] ret_from_fork+0x35/0x40 [ 464.333577] Allocated by task 1110: [ 464.334381] save_stack+0x1b/0x80 [ 464.335123] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 464.335848] cifs_smb3_do_mount+0xd4/0xb00 [ 464.336619] legacy_get_tree+0x6b/0xa0 [ 464.337235] vfs_get_tree+0x41/0x110 [ 464.337975] fc_mount+0xa/0x40 [ 464.338557] vfs_kern_mount.part.0+0x6c/0x80 [ 464.339227] cifs_dfs_d_automount+0x336/0xd29 [ 464.339846] follow_managed+0x1b1/0x450 [ 464.340449] lookup_fast+0x231/0x4a0 [ 464.341039] path_openat+0x240/0x1fd0 [ 464.341634] do_filp_open+0x126/0x1c0 [ 464.342277] do_sys_open+0x1eb/0x2c0 [ 464.342957] do_syscall_64+0x5e/0x190 [ 464.343555] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 464.344772] Freed by task 0: [ 464.345347] save_stack+0x1b/0x80 [ 464.345966] __kasan_slab_free+0x12c/0x170 [ 464.346576] kfree+0xa6/0x270 [ 464.347211] rcu_core+0x39c/0xc80 [ 464.347800] __do_softirq+0x10d/0x3da [ 464.348919] The buggy address belongs to the object at ffff888155e58000 which belongs to the cache kmalloc-256 of size 256 [ 464.350222] The buggy address is located 208 bytes inside of 256-byte region [ffff888155e58000, ffff888155e58100) [ 464.351575] The buggy address belongs to the page: [ 464.352333] page:ffffea0005579600 refcount:1 mapcount:0 mapping:ffff88815a803400 index:0x0 compound_mapcount: 0 [ 464.353583] flags: 0x200000000010200(slab|head) [ 464.354209] raw: 0200000000010200 ffffea0005576200 0000000400000004 ffff88815a803400 [ 464.355353] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 464.356458] page dumped because: kasan: bad access detected [ 464.367005] Memory state around the buggy address: [ 464.367787] ffff888155e57f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 464.368877] ffff888155e58000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 464.369967] >ffff888155e58080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 464.371111] ^ [ 464.371775] ffff888155e58100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 464.372893] ffff888155e58180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 464.373983] ================================================================== Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz> Reviewed-by: Aurelien Aptel <aaptel@suse.com> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-01-04 19:18:24 +01:00
..
Kconfig	various cifs/smb3 fixes (including for share deleted cases) and features including improved encrypted read performance, and various debugging improvements	2019-09-19 10:32:16 -07:00
Makefile	cifs: Add support for root file systems	2019-09-16 11:43:38 -05:00
asn1.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156	2019-05-30 11:26:35 -07:00
cache.c	cifs: use 64-bit timestamps for fscache	2018-08-07 14:15:41 -05:00
cifs_debug.c	cifs: Don't display RDMA transport on reconnect	2019-12-21 11:04:43 +01:00
cifs_debug.h	cifs: add a debug macro that prints \\server\share for errors	2019-09-16 11:43:38 -05:00
cifs_dfs_ref.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
cifs_fs_sb.h	smb3: add mount option to allow RW caching of share accessed by only 1 client	2019-09-16 11:43:38 -05:00
cifs_ioctl.h	smb3: allow decryption keys to be dumped by admin for debugging	2019-09-21 06:02:26 -05:00
cifs_spnego.c	Revert "Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs"	2019-07-10 18:43:43 -07:00
cifs_spnego.h	[CIFS] Rename three structures to avoid camel case	2011-05-27 04:34:02 +00:00
cifs_unicode.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156	2019-05-30 11:26:35 -07:00
cifs_unicode.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156	2019-05-30 11:26:35 -07:00
cifs_uniupr.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156	2019-05-30 11:26:35 -07:00
cifsacl.c	cifs: modefromsid: write mode ACE first	2019-09-16 18:49:11 -05:00
cifsacl.h	smb3: missing ACL related flags	2019-09-26 16:37:43 -05:00
cifsencrypt.c	fs: cifs: switch to RC4 library interface	2019-06-20 14:19:55 +08:00
cifsfs.c	cifs: clarify comment about timestamp granularity for old servers	2019-10-20 19:19:49 -05:00
cifsfs.h	cifs: update internal module version number	2019-09-16 19:18:39 -05:00
cifsglob.h	CIFS: Fix NULL pointer dereference in mid callback	2019-12-21 11:04:46 +01:00
cifspdu.h	smb3: missing defines and structs for reparse point handling	2018-11-02 14:09:41 -05:00
cifsproto.h	cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs	2019-10-24 21:35:04 -05:00
cifsroot.c	cifs: cifsroot: add more err checking	2019-09-16 11:43:39 -05:00
cifssmb.c	smb3: pass mode bits into create calls	2019-09-26 02:06:42 -05:00
connect.c	cifs: Fix use-after-free bug in cifs_reconnect()	2020-01-04 19:18:24 +01:00
dfs_cache.c	fs: cifs: Drop unlikely before IS_ERR(_OR_NULL)	2019-07-07 22:37:42 -05:00
dfs_cache.h	cifs: Fix DFS cache refresher for DFS links	2019-05-07 23:24:54 -05:00
dir.c	CIFS: Force reval dentry if LOOKUP_REVAL flag is set	2019-10-09 00:10:50 -05:00
dns_resolve.c	keys: Pass the network namespace into request_key mechanism	2019-06-27 23:02:12 +01:00
dns_resolve.h	DNS: Separate out CIFS DNS Resolver code	2010-08-05 17:17:51 +00:00
export.c	docs: fs: convert docs without extension to ReST	2019-07-31 13:31:05 -06:00
file.c	CIFS: Respect O_SYNC and O_DIRECT flags during reconnect	2019-12-21 11:04:44 +01:00
fscache.c	cifs: use 64-bit timestamps for fscache	2018-08-07 14:15:41 -05:00
fscache.h	cifs: use 64-bit timestamps for fscache	2018-08-07 14:15:41 -05:00
inode.c	cifs: Fix missed free operations	2019-10-20 19:19:49 -05:00
ioctl.c	smb3: allow decryption keys to be dumped by admin for debugging	2019-09-21 06:02:26 -05:00
link.c	SMB3: Clean up query symlink when reparse point	2019-05-07 23:24:55 -05:00
misc.c	cifs: replace various strncpy with strscpy and similar	2019-08-27 17:25:12 -05:00
netmisc.c	fs: cifs: mute -Wunused-const-variable message	2019-10-06 22:04:35 -05:00
nterr.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61	2019-05-24 17:36:45 +02:00
nterr.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61	2019-05-24 17:36:45 +02:00
ntlmssp.h	cifs: dynamic allocation of ntlmssp blob	2016-06-23 23:45:07 -05:00
readdir.c	cifs: check ntwrk_buf_start for NULL before dereferencing it	2018-12-23 22:41:31 -06:00
rfc1002pdu.h	…
sess.c	fs/cifs/sess.c: Remove set but not used variable 'capabilities'	2019-09-23 22:51:57 -05:00
smb1ops.c	CIFS: avoid using MID 0xFFFF	2019-10-20 19:19:49 -05:00
smb2file.c	cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs	2019-10-24 21:35:04 -05:00
smb2glob.h	cifs: change SMB2_OP_RENAME and SMB2_OP_HARDLINK to use compounding	2018-10-23 21:16:04 -05:00
smb2inode.c	smb3: pass mode bits into create calls	2019-09-26 02:06:42 -05:00
smb2maperror.c	smb3: improve handling of share deleted (and share recreated)	2019-09-16 11:43:38 -05:00
smb2misc.c	CIFS: Close open handle after interrupted close	2019-12-21 11:04:45 +01:00
smb2ops.c	CIFS: Fix NULL pointer dereference in mid callback	2019-12-21 11:04:46 +01:00
smb2pdu.c	CIFS: Close open handle after interrupted close	2019-12-21 11:04:45 +01:00
smb2pdu.h	SMB3: Fix persistent handles reconnect	2019-11-06 21:32:18 -06:00
smb2proto.h	CIFS: Close open handle after interrupted close	2019-12-21 11:04:45 +01:00
smb2status.h	cifs: don't use __constant_cpu_to_le32()	2019-05-07 23:24:54 -05:00
smb2transport.c	smb3: allow skipping signature verification for perf sensitive configurations	2019-09-16 11:43:38 -05:00
smbdirect.c	cifs: smbd: Return -ECONNABORTED when trasnport is not in connected state	2019-12-21 11:04:43 +01:00
smbdirect.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157	2019-05-30 11:26:37 -07:00
smbencrypt.c	fs: cifs: move from the crypto cipher API to the new DES library interface	2019-08-22 14:57:34 +10:00
smberr.h	cifs: map NT_STATUS_ERROR_WRITE_PROTECTED to -EROFS	2010-08-02 12:40:40 +00:00
smbfsctl.h	smb3: Add missing reparse tags	2019-09-24 23:31:32 -05:00
trace.c	smb3: Cleanup license mess	2019-01-24 09:37:33 -06:00
trace.h	smb3: add missing worker function for SMB3 change notify	2019-09-16 11:43:39 -05:00
transport.c	CIFS: Do not miss cancelled OPEN responses	2019-12-21 11:04:45 +01:00
winucase.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156	2019-05-30 11:26:35 -07:00
xattr.c	CIFS: fix max ea value size	2019-09-23 23:28:59 -05:00