2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2024-08-22 08:21:00 +00:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2024-11-22 16:33:25 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-21 17:05:56 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-05-03 16:45:00 +09:00
|
|
|
|
|
|
|
|
|
2021-03-30 12:35:23 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-07-16 14:52:46 +09:00
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2021-03-30 14:25:35 +09:00
|
|
|
|
2021-05-26 18:01:08 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
2021-05-26 18:01:08 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-07-16 14:52:46 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2023-09-19 23:19:29 +09:00
|
|
|
|
|
|
|
|
|
2021-07-16 14:52:46 +09:00
|
|
|
|
2023-09-19 23:19:29 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-07-16 14:52:46 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-07-16 14:52:46 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-07-16 14:52:46 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-07-16 14:52:46 +09:00
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-05-26 17:57:12 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2021-03-30 14:25:35 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2023-08-29 23:39:31 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
2021-03-30 14:25:35 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2024-04-11 23:02:15 +09:00
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2024-04-11 23:02:15 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-06-15 22:05:29 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2023-06-15 22:05:29 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2023-06-15 22:05:29 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-07-16 14:52:46 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-08-29 23:39:31 +09:00
|
|
|
|
|
|
|
|
|
2021-05-26 17:57:12 +09:00
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
2023-08-29 23:39:31 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
2023-10-05 11:22:03 +09:00
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
2021-03-30 14:25:35 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2022-09-22 23:35:43 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
2024-12-05 21:38:47 +09:00
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-21 17:05:56 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-07-28 23:35:18 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ksmbd: fix use-after-free in SMB request handling
A race condition exists between SMB request handling in
`ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the
workqueue handler `handle_ksmbd_work()`. This leads to a UAF.
- KASAN: slab-use-after-free Read in handle_ksmbd_work
- KASAN: slab-use-after-free in rtlock_slowlock_locked
This race condition arises as follows:
- `ksmbd_conn_handler_loop()` waits for `conn->r_count` to reach zero:
`wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);`
- Meanwhile, `handle_ksmbd_work()` decrements `conn->r_count` using
`atomic_dec_return(&conn->r_count)`, and if it reaches zero, calls
`ksmbd_conn_free()`, which frees `conn`.
- However, after `handle_ksmbd_work()` decrements `conn->r_count`,
it may still access `conn->r_count_q` in the following line:
`waitqueue_active(&conn->r_count_q)` or `wake_up(&conn->r_count_q)`
This results in a UAF, as `conn` has already been freed.
The discovery of this UAF can be referenced in the following PR for
syzkaller's support for SMB requests.
Link: https://github.com/google/syzkaller/pull/5524
Fixes: ee426bfb9d09 ("ksmbd: add refcnt to ksmbd_conn struct")
Cc: linux-cifs@vger.kernel.org
Cc: stable@vger.kernel.org # v6.6.55+, v6.10.14+, v6.11.3+
Cc: syzkaller@googlegroups.com
Signed-off-by: Yunseong Kim <yskelg@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2024-11-25 16:45:55 +09:00
|
|
|
|
2022-07-28 23:35:18 +09:00
|
|
|
|
|
|
|
|
|
ksmbd: fix use-after-free in SMB request handling
A race condition exists between SMB request handling in
`ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the
workqueue handler `handle_ksmbd_work()`. This leads to a UAF.
- KASAN: slab-use-after-free Read in handle_ksmbd_work
- KASAN: slab-use-after-free in rtlock_slowlock_locked
This race condition arises as follows:
- `ksmbd_conn_handler_loop()` waits for `conn->r_count` to reach zero:
`wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);`
- Meanwhile, `handle_ksmbd_work()` decrements `conn->r_count` using
`atomic_dec_return(&conn->r_count)`, and if it reaches zero, calls
`ksmbd_conn_free()`, which frees `conn`.
- However, after `handle_ksmbd_work()` decrements `conn->r_count`,
it may still access `conn->r_count_q` in the following line:
`waitqueue_active(&conn->r_count_q)` or `wake_up(&conn->r_count_q)`
This results in a UAF, as `conn` has already been freed.
The discovery of this UAF can be referenced in the following PR for
syzkaller's support for SMB requests.
Link: https://github.com/google/syzkaller/pull/5524
Fixes: ee426bfb9d09 ("ksmbd: add refcnt to ksmbd_conn struct")
Cc: linux-cifs@vger.kernel.org
Cc: stable@vger.kernel.org # v6.6.55+, v6.10.14+, v6.11.3+
Cc: syzkaller@googlegroups.com
Signed-off-by: Yunseong Kim <yskelg@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2024-11-25 16:45:55 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2024-09-25 15:43:23 +08:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-07-23 15:27:37 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2024-11-04 13:43:06 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
2021-06-28 15:23:19 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2024-12-14 12:17:23 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2024-07-15 08:29:39 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2024-11-22 16:33:25 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-03-25 09:45:37 +01:00
|
|
|
|
2021-05-26 17:57:12 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-12-07 09:29:27 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
2023-03-25 09:45:37 +01:00
|
|
|
|
|
|
|
|
|
2021-05-26 17:57:12 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-06-28 15:23:19 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-05-26 17:57:12 +09:00
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2023-03-25 09:45:37 +01:00
|
|
|
|
2021-05-26 17:57:12 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-12-07 09:29:27 +08:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2022-12-07 09:29:27 +08:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-12-07 09:29:27 +08:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-03-25 09:45:37 +01:00
|
|
|
|
2021-05-26 17:57:12 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-06-18 10:17:37 +09:00
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-06-28 15:23:19 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-23 16:27:04 +03:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2021-06-18 10:17:37 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2021-03-23 16:27:04 +03:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
2021-06-18 10:17:37 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
2021-06-18 10:17:37 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-23 16:27:04 +03:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-23 16:27:04 +03:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-23 16:27:04 +03:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-23 16:27:04 +03:00
|
|
|
|
2021-09-20 19:01:42 -05:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
2021-03-23 16:27:04 +03:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-06-18 10:17:37 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-23 16:27:04 +03:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-03-21 17:05:56 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-05-03 08:51:51 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2021-10-31 09:53:50 +09:00
|
|
|
|
2021-03-16 13:07:11 +09:00
|
|
|
|
|
|
|
|
|