kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/fs/cifs
History
Stefano Brivio 9633d2d5f2 cifs: Fix stack out-of-bounds in smb{2,3}_create_lease_buf() 
commit 729c0c9dd5 upstream.

smb{2,3}_create_lease_buf() store a lease key in the lease
context for later usage on a lease break.

In most paths, the key is currently sourced from data that
happens to be on the stack near local variables for oplock in
SMB2_open() callers, e.g. from open_shroot(), whereas
smb2_open_file() properly allocates space on its stack for it.

The address of those local variables holding the oplock is then
passed to create_lease_buf handlers via SMB2_open(), and 16
bytes near oplock are used. This causes a stack out-of-bounds
access as reported by KASAN on SMB2.1 and SMB3 mounts (first
out-of-bounds access is shown here):

[  111.528823] BUG: KASAN: stack-out-of-bounds in smb3_create_lease_buf+0x399/0x3b0 [cifs]
[  111.530815] Read of size 8 at addr ffff88010829f249 by task mount.cifs/985
[  111.532838] CPU: 3 PID: 985 Comm: mount.cifs Not tainted 4.18.0-rc3+ #91
[  111.534656] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[  111.536838] Call Trace:
[  111.537528]  dump_stack+0xc2/0x16b
[  111.540890]  print_address_description+0x6a/0x270
[  111.542185]  kasan_report+0x258/0x380
[  111.544701]  smb3_create_lease_buf+0x399/0x3b0 [cifs]
[  111.546134]  SMB2_open+0x1ef8/0x4b70 [cifs]
[  111.575883]  open_shroot+0x339/0x550 [cifs]
[  111.591969]  smb3_qfs_tcon+0x32c/0x1e60 [cifs]
[  111.617405]  cifs_mount+0x4f3/0x2fc0 [cifs]
[  111.674332]  cifs_smb3_do_mount+0x263/0xf10 [cifs]
[  111.677915]  mount_fs+0x55/0x2b0
[  111.679504]  vfs_kern_mount.part.22+0xaa/0x430
[  111.684511]  do_mount+0xc40/0x2660
[  111.698301]  ksys_mount+0x80/0xd0
[  111.701541]  do_syscall_64+0x14e/0x4b0
[  111.711807]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  111.713665] RIP: 0033:0x7f372385b5fa
[  111.715311] Code: 48 8b 0d 99 78 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 66 78 2c 00 f7 d8 64 89 01 48
[  111.720330] RSP: 002b:00007ffff27049d8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
[  111.722601] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f372385b5fa
[  111.724842] RDX: 000055c2ecdc73b2 RSI: 000055c2ecdc73f9 RDI: 00007ffff270580f
[  111.727083] RBP: 00007ffff2705804 R08: 000055c2ee976060 R09: 0000000000001000
[  111.729319] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f3723f4d000
[  111.731615] R13: 000055c2ee976060 R14: 00007f3723f4f90f R15: 0000000000000000

[  111.735448] The buggy address belongs to the page:
[  111.737420] page:ffffea000420a7c0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
[  111.739890] flags: 0x17ffffc0000000()
[  111.741750] raw: 0017ffffc0000000 0000000000000000 dead000000000200 0000000000000000
[  111.744216] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[  111.746679] page dumped because: kasan: bad access detected

[  111.750482] Memory state around the buggy address:
[  111.752562]  ffff88010829f100: 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00
[  111.754991]  ffff88010829f180: 00 00 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00
[  111.757401] >ffff88010829f200: 00 00 00 00 00 f1 f1 f1 f1 01 f2 f2 f2 f2 f2 f2
[  111.759801]                                               ^
[  111.762034]  ffff88010829f280: f2 02 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00
[  111.764486]  ffff88010829f300: f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  111.766913] ==================================================================

Lease keys are however already generated and stored in fid data
on open and create paths: pass them down to the lease context
creation handlers and use them.

Suggested-by: Aurélien Aptel <aaptel@suse.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Fixes: b8c32dbb0d ("CIFS: Request SMB2.1 leases")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-11-20 18:05:36 +00:00
..
asn1.c [CIFS] cifs: Rename cERROR and cFYI to cifs_dbg 2013-05-04 22:17:23 -05:00
cache.c [CIFS] cifs: Rename cERROR and cFYI to cifs_dbg 2013-05-04 22:17:23 -05:00
cifs_debug.c Display number of credits available 2017-02-23 03:54:12 +00:00
cifs_debug.h cifs: Ratelimit kernel log messages 2016-02-03 10:25:06 +00:00
cifs_dfs_ref.c cifs: fix composing of mount options for DFS referrals 2013-05-24 13:08:31 -05:00
cifs_fs_sb.h fs/cifs: make share unaccessible at root level mountable 2017-10-12 15:28:20 +01:00
cifs_spnego.c cifs: Create dedicated keyring for spnego operations 2016-08-22 22:38:03 +01:00
cifs_spnego.h [CIFS] Rename three structures to avoid camel case 2011-05-27 04:34:02 +00:00
cifs_unicode.c [CIFS] fix mount failure with broken pathnames when smb3 mount with mapchars option 2014-06-24 08:10:24 -05:00
cifs_unicode.h cifs: add new case-insensitive conversion routines that are based on wchar_t's 2013-09-08 14:38:05 -05:00
cifs_uniupr.h cifs: correction of unicode header files 2010-08-20 00:46:42 +00:00
cifsacl.c [CIFS] Fix cifsacl mounts over smb2 to not call cifs 2014-02-10 14:08:16 -06:00
cifsacl.h cifs: fix SID binary to string conversion 2012-12-11 11:48:49 -06:00
cifsencrypt.c CIFS: zero sensitive data when freeing 2018-06-16 22:22:01 +01:00
cifsfs.c smb3: directory sync should not return an error 2018-10-21 08:45:59 +01:00
cifsfs.h Fix cifs_uniqueid_to_ino_t() function for s390x 2016-03-24 10:00:57 +00:00
cifsglob.h cifs: Fix stack out-of-bounds in smb{2,3}_create_lease_buf() 2018-11-20 18:05:36 +00:00
cifspdu.h cifs: Use data structures to compute NTLMv2 response offsets 2013-11-11 16:58:11 -06:00
cifsproto.h cifs: Fix use after free of a mid_q_entry 2018-11-20 18:05:35 +00:00
cifssmb.c cifs: Fix infinite loop when using hard mount option 2018-11-20 18:05:36 +00:00
connect.c cifs: Fix use after free of a mid_q_entry 2018-11-20 18:05:35 +00:00
dir.c cifs: do not allow creating sockets except with SMB1 posix exensions 2018-10-21 08:45:33 +01:00
dns_resolve.c cifs: fix composing of mount options for DFS referrals 2013-05-24 13:08:31 -05:00
dns_resolve.h DNS: Separate out CIFS DNS Resolver code 2010-08-05 17:17:51 +00:00
export.c [CIFS] cifs: Rename cERROR and cFYI to cifs_dbg 2013-05-04 22:17:23 -05:00
file.c mm: drop vm_ops->remap_pages and generic_file_remap_pages() stub 2018-10-03 04:09:51 +01:00
fscache.c NFS client updates for Linux 3.13 2013-11-08 05:57:46 +09:00
fscache.h CIFS: FS-Cache: Uncache unread pages in cifs_readpages() before freeing them 2013-09-18 10:17:03 -05:00
inode.c fs/cifs: make share unaccessible at root level mountable 2017-10-12 15:28:20 +01:00
ioctl.c CIFS: fix type confusion in copy offload ioctl 2015-10-06 11:52:27 +01:00
Kconfig [CIFS] SMB3 Signing enablement 2013-06-26 23:45:05 -05:00
link.c SMB3: Fix oops when creating symlinks on smb3 2014-10-05 13:41:04 -07:00
Makefile cifs: add new case-insensitive conversion routines that are based on wchar_t's 2013-09-08 14:38:05 -05:00
misc.c CIFS: zero sensitive data when freeing 2018-06-16 22:22:01 +01:00
netmisc.c cifs: small underflow in cnvrtDosUnixTm() 2017-08-26 02:14:44 +01:00
nterr.c CIFS: Rename 7 error codes to NT_ style 2012-07-24 10:25:10 -05:00
nterr.h CIFS: Rename 7 error codes to NT_ style 2012-07-24 10:25:10 -05:00
ntlmssp.h cifs: dynamic allocation of ntlmssp blob 2016-08-22 22:38:20 +01:00
readdir.c Clarify locking of cifs file and tcon structures and make more granular 2017-02-23 03:54:13 +00:00
rfc1002pdu.h [CIFS] whitespace cleanup 2007-06-05 18:30:44 +00:00
sess.c cifs: dynamic allocation of ntlmssp blob 2016-08-22 22:38:20 +01:00
smb1ops.c cifs: Fix use after free of a mid_q_entry 2018-11-20 18:05:35 +00:00
smb2file.c cifs: Fix stack out-of-bounds in smb{2,3}_create_lease_buf() 2018-11-20 18:05:36 +00:00
smb2glob.h cifs: Limit the overall credit acquired 2017-02-23 03:54:12 +00:00
smb2inode.c Do not send SMB3 SET_INFO request if nothing is changing 2017-02-23 03:54:13 +00:00
smb2maperror.c Fix problem recognizing symlinks 2014-10-09 12:23:48 -07:00
smb2misc.c CIFS: fix oplock break deadlocks 2017-08-26 02:14:45 +01:00
smb2ops.c cifs: Fix stack out-of-bounds in smb{2,3}_create_lease_buf() 2018-11-20 18:05:36 +00:00
smb2pdu.c cifs: Fix stack out-of-bounds in smb{2,3}_create_lease_buf() 2018-11-20 18:05:36 +00:00
smb2pdu.h cifs: Fix stack out-of-bounds in smb{2,3}_create_lease_buf() 2018-11-20 18:05:36 +00:00
smb2proto.h CIFS: Handle mismatched open calls 2017-07-18 18:40:32 +01:00
smb2status.h CIFS: Add SMB2 status codes 2012-07-24 10:25:13 -05:00
smb2transport.c cifs: Fix use after free of a mid_q_entry 2018-11-20 18:05:35 +00:00
smbencrypt.c [CIFS] cifs: Rename cERROR and cFYI to cifs_dbg 2013-05-04 22:17:23 -05:00
smberr.h cifs: map NT_STATUS_ERROR_WRITE_PROTECTED to -EROFS 2010-08-02 12:40:40 +00:00
smbfsctl.h Check SMB3 dialects against downgrade attacks 2013-11-19 23:52:54 -06:00
transport.c cifs: Fix use after free of a mid_q_entry 2018-11-20 18:05:35 +00:00
winucase.c [CIFS] quiet sparse compile warning 2013-09-08 14:54:24 -05:00
xattr.c retrieving CIFS ACLs when mounted with SMB2 fails dropping session 2014-02-07 11:08:17 -06:00