package/kernel/ksmbd/patches/02-fix_zdi_22_1690.patch

   1 From 1f9d85a340b0d8ff14cf47573417fe84efef9731 Mon Sep 17 00:00:00 2001
   2 From: Namjae Jeon <linkinjeon@kernel.org>
   3 Date: Wed, 27 Jul 2022 23:11:47 +0900
   4 Subject: [PATCH] ksmbd: fix use-after-free bug in smb2_tree_disconect
   5
   6 smb2_tree_disconnect() freed the struct ksmbd_tree_connect,
   7 but it left the dangling pointer. It can be accessed
   8 again under compound requests.
   9
  10 This bug can lead an oops looking something link:
  11
  12 [ 1685.468014 ] BUG: KASAN: use-after-free in ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
  13 [ 1685.468068 ] Read of size 4 at addr ffff888102172180 by task kworker/1:2/4807
  14 ...
  15 [ 1685.468130 ] Call Trace:
  16 [ 1685.468132 ]  <TASK>
  17 [ 1685.468135 ]  dump_stack_lvl+0x49/0x5f
  18 [ 1685.468141 ]  print_report.cold+0x5e/0x5cf
  19 [ 1685.468145 ]  ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
  20 [ 1685.468157 ]  kasan_report+0xaa/0x120
  21 [ 1685.468194 ]  ? ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
  22 [ 1685.468206 ]  __asan_report_load4_noabort+0x14/0x20
  23 [ 1685.468210 ]  ksmbd_tree_conn_disconnect+0x131/0x160 [ksmbd]
  24 [ 1685.468222 ]  smb2_tree_disconnect+0x175/0x250 [ksmbd]
  25 [ 1685.468235 ]  handle_ksmbd_work+0x30e/0x1020 [ksmbd]
  26 [ 1685.468247 ]  process_one_work+0x778/0x11c0
  27 [ 1685.468251 ]  ? _raw_spin_lock_irq+0x8e/0xe0
  28 [ 1685.468289 ]  worker_thread+0x544/0x1180
  29 [ 1685.468293 ]  ? __cpuidle_text_end+0x4/0x4
  30 [ 1685.468297 ]  kthread+0x282/0x320
  31 [ 1685.468301 ]  ? process_one_work+0x11c0/0x11c0
  32 [ 1685.468305 ]  ? kthread_complete_and_exit+0x30/0x30
  33 [ 1685.468309 ]  ret_from_fork+0x1f/0x30
  34
  35 Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-17816
  36 Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
  37 Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
  38 ---
  39  smb2pdu.c | 1 +
  40  1 file changed, 1 insertion(+)
  41
  42 diff --git a/smb2pdu.c b/smb2pdu.c
  43 index 15bded43..1396ec49 100644
  44 --- a/smb2pdu.c
  45 +++ b/smb2pdu.c
  46 @@ -2059,6 +2059,7 @@ int smb2_tree_disconnect(struct ksmbd_work *work)
  47
  48         ksmbd_close_tree_conn_fds(work);
  49         ksmbd_tree_conn_disconnect(sess, tcon);
  50 +       work->tcon = NULL;
  51         return 0;
  52  }
  53