linux-kernel - [PATCH] cifsd: fix potential UAF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20230727095911.3657425-1-qi.zheng@linux.dev>
Date:   Thu, 27 Jul 2023 09:59:11 +0000
From:   Qi Zheng <qi.zheng@...ux.dev>
To:     linkinjeon@...nel.org, sfrench@...ba.org, senozhatsky@...omium.org,
        tom@...pey.com, hyc.lee@...il.com, lsahlber@...hat.com,
        paulmck@...nel.org
Cc:     linux-cifs@...r.kernel.org, linux-kernel@...r.kernel.org,
        Qi Zheng <zhengqi.arch@...edance.com>
Subject: [PATCH] cifsd: fix potential UAF

From: Qi Zheng <zhengqi.arch@...edance.com>

After calling opinfo_put(), the opinfo may be freed, then using this
opinfo in the next traversal will cause UAF bug.

To fix it, swap the call order of opinfo_put() and rcu_read_lock(), so
that the opinfo_free_rcu() will not be called, and the opinfo will not be
freed, then we can safely perform the next traversal.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: Qi Zheng <zhengqi.arch@...edance.com>
---
 fs/smb/server/oplock.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c
index 844b303baf29..a0e47eb2df83 100644
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -1021,8 +1021,8 @@ int find_same_lease_key(struct ksmbd_session *sess, struct ksmbd_inode *ci,
 			goto out;
 		}
 op_next:
-		opinfo_put(opinfo);
 		rcu_read_lock();
+		opinfo_put(opinfo);
 	}
 	rcu_read_unlock();
 
@@ -1314,8 +1314,8 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp,
 		brk_op->open_trunc = is_trunc;
 		oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE);
 next:
-		opinfo_conn_put(brk_op);
 		rcu_read_lock();
+		opinfo_conn_put(brk_op);
 	}
 	rcu_read_unlock();
 
@@ -1711,8 +1711,8 @@ struct oplock_info *lookup_lease_in_table(struct ksmbd_conn *conn,
 			goto out;
 		}
 op_next:
-		opinfo_put(opinfo);
 		rcu_read_lock();
+		opinfo_put(opinfo);
 	}
 	rcu_read_unlock();
 
-- 
2.30.2