microsoft
/
WSL2-Linux-Kernel
зеркало из https://github.com/microsoft/WSL2-Linux-Kernel.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
WSL2-Linux-Kernel/fs/cifs
История
Vincent Whitchurch f1f27ad745 CIFS: Fix task struct use-after-free on reconnect 
The task which created the MID may be gone by the time cifsd attempts to
call the callbacks on MIDs from cifs_reconnect().

This leads to a use-after-free of the task struct in cifs_wake_up_task:

 ==================================================================
 BUG: KASAN: use-after-free in __lock_acquire+0x31a0/0x3270
 Read of size 8 at addr ffff8880103e3a68 by task cifsd/630

 CPU: 0 PID: 630 Comm: cifsd Not tainted 5.5.0-rc6+ #119
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
 Call Trace:
  dump_stack+0x8e/0xcb
  print_address_description.constprop.5+0x1d3/0x3c0
  ? __lock_acquire+0x31a0/0x3270
  __kasan_report+0x152/0x1aa
  ? __lock_acquire+0x31a0/0x3270
  ? __lock_acquire+0x31a0/0x3270
  kasan_report+0xe/0x20
  __lock_acquire+0x31a0/0x3270
  ? __wake_up_common+0x1dc/0x630
  ? _raw_spin_unlock_irqrestore+0x4c/0x60
  ? mark_held_locks+0xf0/0xf0
  ? _raw_spin_unlock_irqrestore+0x39/0x60
  ? __wake_up_common_lock+0xd5/0x130
  ? __wake_up_common+0x630/0x630
  lock_acquire+0x13f/0x330
  ? try_to_wake_up+0xa3/0x19e0
  _raw_spin_lock_irqsave+0x38/0x50
  ? try_to_wake_up+0xa3/0x19e0
  try_to_wake_up+0xa3/0x19e0
  ? cifs_compound_callback+0x178/0x210
  ? set_cpus_allowed_ptr+0x10/0x10
  cifs_reconnect+0xa1c/0x15d0
  ? generic_ip_connect+0x1860/0x1860
  ? rwlock_bug.part.0+0x90/0x90
  cifs_readv_from_socket+0x479/0x690
  cifs_read_from_socket+0x9d/0xe0
  ? cifs_readv_from_socket+0x690/0x690
  ? mempool_resize+0x690/0x690
  ? rwlock_bug.part.0+0x90/0x90
  ? memset+0x1f/0x40
  ? allocate_buffers+0xff/0x340
  cifs_demultiplex_thread+0x388/0x2a50
  ? cifs_handle_standard+0x610/0x610
  ? rcu_read_lock_held_common+0x120/0x120
  ? mark_lock+0x11b/0xc00
  ? __lock_acquire+0x14ed/0x3270
  ? __kthread_parkme+0x78/0x100
  ? lockdep_hardirqs_on+0x3e8/0x560
  ? lock_downgrade+0x6a0/0x6a0
  ? lockdep_hardirqs_on+0x3e8/0x560
  ? _raw_spin_unlock_irqrestore+0x39/0x60
  ? cifs_handle_standard+0x610/0x610
  kthread+0x2bb/0x3a0
  ? kthread_create_worker_on_cpu+0xc0/0xc0
  ret_from_fork+0x3a/0x50

 Allocated by task 649:
  save_stack+0x19/0x70
  __kasan_kmalloc.constprop.5+0xa6/0xf0
  kmem_cache_alloc+0x107/0x320
  copy_process+0x17bc/0x5370
  _do_fork+0x103/0xbf0
  __x64_sys_clone+0x168/0x1e0
  do_syscall_64+0x9b/0xec0
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

 Freed by task 0:
  save_stack+0x19/0x70
  __kasan_slab_free+0x11d/0x160
  kmem_cache_free+0xb5/0x3d0
  rcu_core+0x52f/0x1230
  __do_softirq+0x24d/0x962

 The buggy address belongs to the object at ffff8880103e32c0
  which belongs to the cache task_struct of size 6016
 The buggy address is located 1960 bytes inside of
  6016-byte region [ffff8880103e32c0, ffff8880103e4a40)
 The buggy address belongs to the page:
 page:ffffea000040f800 refcount:1 mapcount:0 mapping:ffff8880108da5c0
 index:0xffff8880103e4c00 compound_mapcount: 0
 raw: 4000000000010200 ffffea00001f2208 ffffea00001e3408 ffff8880108da5c0
 raw: ffff8880103e4c00 0000000000050003 00000001ffffffff 0000000000000000
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
  ffff8880103e3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8880103e3980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 >ffff8880103e3a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                           ^
  ffff8880103e3a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8880103e3b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ==================================================================

This can be reliably reproduced by adding the below delay to
cifs_reconnect(), running find(1) on the mount, restarting the samba
server while find is running, and killing find during the delay:

  	spin_unlock(&GlobalMid_Lock);
  	mutex_unlock(&server->srv_mutex);

 +	msleep(10000);
 +
  	cifs_dbg(FYI, "%s: issuing mid callbacks\n", __func__);
  	list_for_each_safe(tmp, tmp2, &retry_list) {
  		mid_entry = list_entry(tmp, struct mid_q_entry, qhead);

Fix this by holding a reference to the task struct until the MID is
freed.

Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
CC: Stable <stable@vger.kernel.org>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
 		2020-01-26 19:24:17 -06:00
..
Kconfig various cifs/smb3 fixes (including for share deleted cases) and features including improved encrypted read performance, and various debugging improvements 2019-09-19 10:32:16 -07:00
Makefile cifs: Add support for root file systems 2019-09-16 11:43:38 -05:00
asn1.c
…
cache.c
…
cifs_debug.c cifs: dump channel info in DebugData 2019-11-25 01:17:12 -06:00
cifs_debug.h cifs: add a debug macro that prints \\server\share for errors 2019-09-16 11:43:38 -05:00
cifs_dfs_ref.c cifs: Fix mount options set in automount 2020-01-26 19:24:16 -06:00
cifs_fs_sb.h smb3: add mount option to allow RW caching of share accessed by only 1 client 2019-09-16 11:43:38 -05:00
cifs_ioctl.h smb3: allow decryption keys to be dumped by admin for debugging 2019-09-21 06:02:26 -05:00
cifs_spnego.c cifs: switch servers depending on binding state 2019-11-25 01:16:30 -06:00
cifs_spnego.h
…
cifs_unicode.c
…
cifs_unicode.h
…
cifs_uniupr.h
…
cifsacl.c smb3: fix default permissions on new files when mounting with modefromsid 2020-01-26 19:24:17 -06:00
cifsacl.h smb3: fix mode passed in on create for modetosid mount option 2019-12-06 14:15:52 -06:00
cifsencrypt.c
…
cifsfs.c Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-12-06 09:06:58 -08:00
cifsfs.h cifs: add support for fallocate mode 0 for non-sparse files 2020-01-26 19:24:17 -06:00
cifsglob.h CIFS: Fix task struct use-after-free on reconnect 2020-01-26 19:24:17 -06:00
cifspdu.h
…
cifsproto.h smb3: fix default permissions on new files when mounting with modefromsid 2020-01-26 19:24:17 -06:00
cifsroot.c cifs: cifsroot: add more err checking 2019-09-16 11:43:39 -05:00
cifssmb.c fs/cifs/cifssmb.c: use true,false for bool variable 2020-01-26 19:24:16 -06:00
connect.c cifs: fix NULL dereference in match_prepath 2020-01-26 19:24:17 -06:00
dfs_cache.c cifs: use PTR_ERR_OR_ZERO() to simplify code 2020-01-26 19:24:17 -06:00
dfs_cache.h
…
dir.c CIFS: Return directly after a failed build_path_from_dentry() in cifs_do_create() 2019-11-25 01:14:53 -06:00
dns_resolve.c
…
dns_resolve.h
…
export.c
…
file.c cifs: Don't use iov_iter::type directly 2020-01-26 19:24:16 -06:00
fscache.c
…
fscache.h
…
inode.c cifs: add support for fallocate mode 0 for non-sparse files 2020-01-26 19:24:17 -06:00
ioctl.c smb3: allow decryption keys to be dumped by admin for debugging 2019-09-21 06:02:26 -05:00
link.c
…
misc.c CIFS: Properly process SMB3 lease breaks 2019-11-25 01:17:12 -06:00
netmisc.c fs: cifs: mute -Wunused-const-variable message 2019-10-06 22:04:35 -05:00
nterr.c
…
nterr.h
…
ntlmssp.h
…
readdir.c cifs: Optimize readdir on reparse points 2019-12-23 09:04:44 -06:00
rfc1002pdu.h
…
sess.c cifs: fix possible uninitialized access and race on iface_list 2019-12-04 11:51:18 -06:00
smb1ops.c CIFS: Properly process SMB3 lease breaks 2019-11-25 01:17:12 -06:00
smb2file.c cifs: Adjust indentation in smb2_open_file 2019-12-23 09:04:44 -06:00
smb2glob.h
…
smb2inode.c SMB3: Fix crash in SMB2_open_init due to uninitialized field in compounding path 2019-12-13 00:49:38 -06:00
smb2maperror.c smb3: improve handling of share deleted (and share recreated) 2019-09-16 11:43:38 -05:00
smb2misc.c cifs: Fix memory allocation in __smb2_handle_cancelled_cmd() 2020-01-26 19:24:17 -06:00
smb2ops.c cifs: add support for fallocate mode 0 for non-sparse files 2020-01-26 19:24:17 -06:00
smb2pdu.c smb3: fix default permissions on new files when mounting with modefromsid 2020-01-26 19:24:17 -06:00
smb2pdu.h cifs: prepare SMB2_query_directory to be used with compounding 2020-01-26 19:24:16 -06:00
smb2proto.h cifs: prepare SMB2_query_directory to be used with compounding 2020-01-26 19:24:16 -06:00
smb2status.h
…
smb2transport.c CIFS: Fix task struct use-after-free on reconnect 2020-01-26 19:24:17 -06:00
smbdirect.c cifs: smbd: Only queue work for error recovery on memory registration 2019-11-25 01:16:30 -06:00
smbdirect.h
…
smbencrypt.c
…
smberr.h
…
smbfsctl.h smb3: Add missing reparse tags 2019-09-24 23:31:32 -05:00
trace.c
…
trace.h smb3: add missing worker function for SMB3 change notify 2019-09-16 11:43:39 -05:00
transport.c CIFS: Fix task struct use-after-free on reconnect 2020-01-26 19:24:17 -06:00
winucase.c
…
xattr.c CIFS: Add support for setting owner info, dos attributes, and create time 2020-01-26 19:24:17 -06:00