This is a note to let you know that I've just added the patch titled
cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname
to the 6.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
cifs-fix-potential-use-after-free-bugs-in-tcp_server_info-hostname.patch
and it can be found in the queue-6.2 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 90c49fce1c43e1cc152695e20363ff5087897c09 Mon Sep 17 00:00:00 2001
From: Paulo Alcantara <pc@xxxxxxxxxxxxx>
Date: Fri, 21 Apr 2023 15:52:32 -0300
Subject: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname
From: Paulo Alcantara <pc@xxxxxxxxxxxxx>
commit 90c49fce1c43e1cc152695e20363ff5087897c09 upstream.
TCP_Server_Info::hostname may be updated once or many times during
reconnect, so protect its access outside reconnect path as well and
then prevent any potential use-after-free bugs.
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Paulo Alcantara (SUSE) <pc@xxxxxxxxxxxxx>
Signed-off-by: Steve French <stfrench@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/cifs/cifs_debug.c | 7 ++++++-
fs/cifs/cifs_debug.h | 12 ++++++------
fs/cifs/connect.c | 10 +++++++---
fs/cifs/sess.c | 7 ++++---
4 files changed, 23 insertions(+), 13 deletions(-)
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -279,8 +279,10 @@ static int cifs_debug_data_proc_show(str
seq_printf(m, "\n%d) ConnectionId: 0x%llx ",
c, server->conn_id);
+ spin_lock(&server->srv_lock);
if (server->hostname)
seq_printf(m, "Hostname: %s ", server->hostname);
+ spin_unlock(&server->srv_lock);
#ifdef CONFIG_CIFS_SMB_DIRECT
if (!server->rdma)
goto skip_rdma;
@@ -620,10 +622,13 @@ static int cifs_stats_proc_show(struct s
server->fastest_cmd[j],
server->slowest_cmd[j]);
for (j = 0; j < NUMBER_OF_SMB2_COMMANDS; j++)
- if (atomic_read(&server->smb2slowcmd[j]))
+ if (atomic_read(&server->smb2slowcmd[j])) {
+ spin_lock(&server->srv_lock);
seq_printf(m, " %d slow responses from %s for command %d\n",
atomic_read(&server->smb2slowcmd[j]),
server->hostname, j);
+ spin_unlock(&server->srv_lock);
+ }
#endif /* STATS2 */
list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
--- a/fs/cifs/cifs_debug.h
+++ b/fs/cifs/cifs_debug.h
@@ -81,19 +81,19 @@ do { \
#define cifs_server_dbg_func(ratefunc, type, fmt, ...) \
do { \
- const char *sn = ""; \
- if (server && server->hostname) \
- sn = server->hostname; \
+ spin_lock(&server->srv_lock); \
if ((type) & FYI && cifsFYI & CIFS_INFO) { \
pr_debug_ ## ratefunc("%s: \\\\%s " fmt, \
- __FILE__, sn, ##__VA_ARGS__); \
+ __FILE__, server->hostname, \
+ ##__VA_ARGS__); \
} else if ((type) & VFS) { \
pr_err_ ## ratefunc("VFS: \\\\%s " fmt, \
- sn, ##__VA_ARGS__); \
+ server->hostname, ##__VA_ARGS__); \
} else if ((type) & NOISY && (NOISY != 0)) { \
pr_debug_ ## ratefunc("\\\\%s " fmt, \
- sn, ##__VA_ARGS__); \
+ server->hostname, ##__VA_ARGS__); \
} \
+ spin_unlock(&server->srv_lock); \
} while (0)
#define cifs_server_dbg(type, fmt, ...) \
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -435,8 +435,10 @@ static int __reconnect_target_unlocked(s
if (server->hostname != target) {
hostname = extract_hostname(target);
if (!IS_ERR(hostname)) {
+ spin_lock(&server->srv_lock);
kfree(server->hostname);
server->hostname = hostname;
+ spin_unlock(&server->srv_lock);
} else {
cifs_dbg(FYI, "%s: couldn't extract hostname or address from dfs target: %ld\n",
__func__, PTR_ERR(hostname));
@@ -593,9 +595,7 @@ cifs_echo_request(struct work_struct *wo
goto requeue_echo;
rc = server->ops->echo ? server->ops->echo(server) : -ENOSYS;
- if (rc)
- cifs_dbg(FYI, "Unable to send echo request to server: %s\n",
- server->hostname);
+ cifs_server_dbg(FYI, "send echo request: rc = %d\n", rc);
/* Check witness registrations */
cifs_swn_check();
@@ -1445,6 +1445,8 @@ static int match_server(struct TCP_Serve
{
struct sockaddr *addr = (struct sockaddr *)&ctx->dstaddr;
+ lockdep_assert_held(&server->srv_lock);
+
if (ctx->nosharesock)
return 0;
@@ -1859,7 +1861,9 @@ cifs_setup_ipc(struct cifs_ses *ses, str
if (tcon == NULL)
return -ENOMEM;
+ spin_lock(&server->srv_lock);
scnprintf(unc, sizeof(unc), "\\\\%s\\IPC$", server->hostname);
+ spin_unlock(&server->srv_lock);
xid = get_xid();
tcon->ses = ses;
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -159,6 +159,7 @@ cifs_chan_is_iface_active(struct cifs_se
/* returns number of channels added */
int cifs_try_adding_channels(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses)
{
+ struct TCP_Server_Info *server = ses->server;
int old_chan_count, new_chan_count;
int left;
int rc = 0;
@@ -178,16 +179,16 @@ int cifs_try_adding_channels(struct cifs
return 0;
}
- if (ses->server->dialect < SMB30_PROT_ID) {
+ if (server->dialect < SMB30_PROT_ID) {
spin_unlock(&ses->chan_lock);
cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
return 0;
}
- if (!(ses->server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
+ if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
ses->chan_max = 1;
spin_unlock(&ses->chan_lock);
- cifs_dbg(VFS, "server %s does not support multichannel\n", ses->server->hostname);
+ cifs_server_dbg(VFS, "no multichannel support\n");
return 0;
}
spin_unlock(&ses->chan_lock);
Patches currently in stable-queue which might be from pc@xxxxxxxxxxxxx are
queue-6.2/cifs-protect-access-of-tcp_server_info-origin-leaf-_fullpath.patch
queue-6.2/cifs-fix-sharing-of-dfs-connections.patch
queue-6.2/cifs-fix-potential-use-after-free-bugs-in-tcp_server_info-hostname.patch
queue-6.2/smb3-add-missing-locks-to-protect-deferred-close-fil.patch
queue-6.2/cifs-fix-potential-race-when-tree-connecting-ipc.patch
queue-6.2/cifs-protect-session-status-check-in-smb2_reconnect.patch
