mirror of
https://github.com/torvalds/linux.git
synced 2024-10-24 22:20:55 +00:00
e79b0332ae
Fix tcon use-after-free and NULL ptr deref.
Customer system crashes with the following kernel log:
[462233.169868] CIFS VFS: Cancelling wait for mid 4894753 cmd: 14 => a QUERY DIR
[462233.228045] CIFS VFS: cifs_put_smb_ses: Session Logoff failure rc=-4
[462233.305922] CIFS VFS: cifs_put_smb_ses: Session Logoff failure rc=-4
[462233.306205] CIFS VFS: cifs_put_smb_ses: Session Logoff failure rc=-4
[462233.347060] CIFS VFS: cifs_put_smb_ses: Session Logoff failure rc=-4
[462233.347107] CIFS VFS: Close unmatched open
[462233.347113] BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
...
[exception RIP: cifs_put_tcon+0xa0] (this is doing tcon->ses->server)
#6 [...] smb2_cancelled_close_fid at ... [cifs]
#7 [...] process_one_work at ...
#8 [...] worker_thread at ...
#9 [...] kthread at ...
The most likely explanation we have is:
* When we put the last reference of a tcon (refcount=0), we close the
cached share root handle.
* If closing a handle is interrupted, SMB2_close() will
queue a SMB2_close() in a work thread.
* The queued object keeps a tcon ref so we bump the tcon
refcount, jumping from 0 to 1.
* We reach the end of cifs_put_tcon(), we free the tcon object despite
it now having a refcount of 1.
* The queued work now runs, but the tcon, ses & server was freed in
the meantime resulting in a crash.
THREAD 1
========
cifs_put_tcon => tcon refcount reach 0
SMB2_tdis
close_shroot_lease
close_shroot_lease_locked => if cached root has lease && refcount = 0
smb2_close_cached_fid => if cached root valid
SMB2_close => retry close in a thread if interrupted
smb2_handle_cancelled_close
__smb2_handle_cancelled_close => !! tcon refcount bump 0 => 1 !!
INIT_WORK(&cancelled->work, smb2_cancelled_close_fid);
queue_work(cifsiod_wq, &cancelled->work) => queue work
tconInfoFree(tcon); ==> freed!
cifs_put_smb_ses(ses); ==> freed!
THREAD 2 (workqueue)
========
smb2_cancelled_close_fid
SMB2_close(0, cancelled->tcon, ...); => use-after-free of tcon
cifs_put_tcon(cancelled->tcon); => tcon refcount reach 0 second time
*CRASH*
Fixes:
|
||
|---|---|---|
| .. | ||
| asn1.c | ||
| cache.c | ||
| cifs_debug.c | ||
| cifs_debug.h | ||
| cifs_dfs_ref.c | ||
| cifs_fs_sb.h | ||
| cifs_ioctl.h | ||
| cifs_spnego.c | ||
| cifs_spnego.h | ||
| cifs_unicode.c | ||
| cifs_unicode.h | ||
| cifs_uniupr.h | ||
| cifsacl.c | ||
| cifsacl.h | ||
| cifsencrypt.c | ||
| cifsfs.c | ||
| cifsfs.h | ||
| cifsglob.h | ||
| cifspdu.h | ||
| cifsproto.h | ||
| cifsroot.c | ||
| cifssmb.c | ||
| connect.c | ||
| dfs_cache.c | ||
| dfs_cache.h | ||
| dir.c | ||
| dns_resolve.c | ||
| dns_resolve.h | ||
| export.c | ||
| file.c | ||
| fscache.c | ||
| fscache.h | ||
| inode.c | ||
| ioctl.c | ||
| Kconfig | ||
| link.c | ||
| Makefile | ||
| misc.c | ||
| netmisc.c | ||
| nterr.c | ||
| nterr.h | ||
| ntlmssp.h | ||
| readdir.c | ||
| rfc1002pdu.h | ||
| sess.c | ||
| smb1ops.c | ||
| smb2file.c | ||
| smb2glob.h | ||
| smb2inode.c | ||
| smb2maperror.c | ||
| smb2misc.c | ||
| smb2ops.c | ||
| smb2pdu.c | ||
| smb2pdu.h | ||
| smb2proto.h | ||
| smb2status.h | ||
| smb2transport.c | ||
| smbdirect.c | ||
| smbdirect.h | ||
| smbencrypt.c | ||
| smberr.h | ||
| smbfsctl.h | ||
| trace.c | ||
| trace.h | ||
| transport.c | ||
| winucase.c | ||
| xattr.c | ||