netdev - [RFC PATCH 5/5] nfsd: fix UAF when access ex_uuid or ex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241216142156.4133267-6-yangerkun@huaweicloud.com>
Date: Mon, 16 Dec 2024 22:21:56 +0800
From: Yang Erkun <yangerkun@...weicloud.com>
To: chuck.lever@...cle.com,
	jlayton@...nel.org,
	neilb@...e.de,
	okorniev@...hat.com,
	Dai.Ngo@...cle.com,
	tom@...pey.com,
	trondmy@...nel.org,
	anna@...nel.org,
	linux-nfs@...r.kernel.org,
	netdev@...r.kernel.org
Cc: yangerkun@...wei.com,
	yangerkun@...weicloud.com,
	yi.zhang@...wei.com
Subject: [RFC PATCH 5/5] nfsd: fix UAF when access ex_uuid or ex_stats

From: Yang Erkun <yangerkun@...wei.com>

svc_export_put free exp protected by rcu, but the other structure like
ex_uuid and ex_stats will directly be freed. So, when e_show/c_show
which protected by rcu access this, UAF can also be triggered. Fix this
by using call_rcu.

Fixes: ae74136b4bb6 ("SUNRPC: Allow cache lookups to use RCU protection rather than the r/w spinlock")
Signed-off-by: Yang Erkun <yangerkun@...wei.com>
---
 fs/nfsd/export.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 1c795dc5a74b..afed9f410092 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -355,16 +355,25 @@ static void export_stats_destroy(struct export_stats *stats)
 					    EXP_STATS_COUNTERS_NUM);
 }
 
-static void svc_export_put(struct kref *ref)
+static void svc_export_release(struct rcu_head *rcu_head)
 {
-	struct svc_export *exp = container_of(ref, struct svc_export, h.ref);
-	path_put(&exp->ex_path);
-	auth_domain_put(exp->ex_client);
+	struct svc_export *exp = container_of(rcu_head, struct svc_export,
+			ex_rcu);
+
 	nfsd4_fslocs_free(&exp->ex_fslocs);
 	export_stats_destroy(exp->ex_stats);
 	kfree(exp->ex_stats);
 	kfree(exp->ex_uuid);
-	kfree_rcu(exp, ex_rcu);
+	kfree(exp);
+}
+
+static void svc_export_put(struct kref *ref)
+{
+	struct svc_export *exp = container_of(ref, struct svc_export, h.ref);
+
+	path_put(&exp->ex_path);
+	auth_domain_put(exp->ex_client);
+	call_rcu(&exp->ex_rcu, svc_export_release);
 }
 
 static int svc_export_upcall(struct cache_detail *cd, struct cache_head *h)
-- 
2.39.2