linux-kernel - Re: [PATCH v2] cifs: fix use-after-free on the link name

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <871qqi1u3a.fsf@cjr.nz>
Date:   Fri, 04 Nov 2022 14:56:57 -0300
From:   Paulo Alcantara <pc@....nz>
To:     ChenXiaoSong <chenxiaosong2@...wei.com>, sfrench@...ba.org,
        lsahlber@...hat.com
Cc:     linux-cifs@...r.kernel.org, samba-technical@...ts.samba.org,
        linux-kernel@...r.kernel.org, chenxiaosong2@...wei.com,
        yi.zhang@...wei.com, zhangxiaoxu5@...wei.com
Subject: Re: [PATCH v2] cifs: fix use-after-free on the link name

ChenXiaoSong <chenxiaosong2@...wei.com> writes:

> When opened a symlink, link name is from 'inode->i_link', but it may be
> reset to a new value when revalidate the dentry. If some processes get the
> link name on the race scenario, then UAF will happen on link name.
>
> Fix this by implementing 'get_link' interface to duplicate the link name.
>
> Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
> Signed-off-by: ChenXiaoSong <chenxiaosong2@...wei.com>
> ---
>  fs/cifs/cifsfs.c | 26 +++++++++++++++++++++++++-
>  fs/cifs/inode.c  |  5 -----
>  2 files changed, 25 insertions(+), 6 deletions(-)

Reviewed-by: Paulo Alcantara (SUSE) <pc@....nz>