lkml.org 
[lkml]   [2023]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] cifsd: fix potential UAF
Date
From: Qi Zheng <zhengqi.arch@bytedance.com>

After calling opinfo_put(), the opinfo may be freed, then using this
opinfo in the next traversal will cause UAF bug.

To fix it, swap the call order of opinfo_put() and rcu_read_lock(), so
that the opinfo_free_rcu() will not be called, and the opinfo will not be
freed, then we can safely perform the next traversal.

Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
---
fs/smb/server/oplock.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c
index 844b303baf29..a0e47eb2df83 100644
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -1021,8 +1021,8 @@ int find_same_lease_key(struct ksmbd_session *sess, struct ksmbd_inode *ci,
goto out;
}
op_next:
- opinfo_put(opinfo);
rcu_read_lock();
+ opinfo_put(opinfo);
}
rcu_read_unlock();

@@ -1314,8 +1314,8 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp,
brk_op->open_trunc = is_trunc;
oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE);
next:
- opinfo_conn_put(brk_op);
rcu_read_lock();
+ opinfo_conn_put(brk_op);
}
rcu_read_unlock();

@@ -1711,8 +1711,8 @@ struct oplock_info *lookup_lease_in_table(struct ksmbd_conn *conn,
goto out;
}
op_next:
- opinfo_put(opinfo);
rcu_read_lock();
+ opinfo_put(opinfo);
}
rcu_read_unlock();

--
2.30.2
\
 
 \ /
  Last update: 2023-07-27 12:00    [W:0.073 / U:0.180 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site