linux-kernel - [PATCH] orangefs: Fix a use after free in purge_waiting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20210428031236.3613-1-lyl2019@mail.ustc.edu.cn>
Date:   Tue, 27 Apr 2021 20:12:36 -0700
From:   Lv Yunlong <lyl2019@...l.ustc.edu.cn>
To:     hubcap@...ibond.com, martin@...ibond.com
Cc:     devel@...ts.orangefs.org, linux-kernel@...r.kernel.org,
        Lv Yunlong <lyl2019@...l.ustc.edu.cn>
Subject: [PATCH] orangefs: Fix a use after free in purge_waiting_ops

In purge_waiting_ops, op is freed in set_op_state_purged()
when op->upcal.type is a cancel type via op_release().But
later the freed op is dereferenced in gossip_debug() via
get_opname_string(op) and op->op_state.

My patch adds variables 'opname' and 'op_state' to avoid
the uaf. But i see that op->op_state could be changed in
a lock environment and i think move all the check condition
outside set_op_state_purged() could be redundant.

Could you give some advice on how to handle the op->op_state?

Fixes: 9d9e7ba9ee8f3 ("Orangefs: improve gossip statements")
Signed-off-by: Lv Yunlong <lyl2019@...l.ustc.edu.cn>
---
 fs/orangefs/waitqueue.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/orangefs/waitqueue.c b/fs/orangefs/waitqueue.c
index beafc33d57be..e00c74051936 100644
--- a/fs/orangefs/waitqueue.c
+++ b/fs/orangefs/waitqueue.c
@@ -34,6 +34,8 @@ static void orangefs_clean_up_interrupted_operation(struct orangefs_kernel_op_s
 void purge_waiting_ops(void)
 {
 	struct orangefs_kernel_op_s *op, *tmp;
+	char *opname;
+	int op_state;
 
 	spin_lock(&orangefs_request_list_lock);
 	list_for_each_entry_safe(op, tmp, &orangefs_request_list, list) {
@@ -41,12 +43,14 @@ void purge_waiting_ops(void)
 			     "pvfs2-client-core: purging op tag %llu %s\n",
 			     llu(op->tag),
 			     get_opname_string(op));
+		opname = get_opname_string(op);
+		op_state = op->op_state;
 		set_op_state_purged(op);
 		gossip_debug(GOSSIP_DEV_DEBUG,
 			     "%s: op:%s: op_state:%d: process:%s:\n",
 			     __func__,
-			     get_opname_string(op),
-			     op->op_state,
+			     opname,
+			     op_state,
 			     current->comm);
 	}
 	spin_unlock(&orangefs_request_list_lock);
-- 
2.25.1