Commit 696e420b authored by Lars Persson's avatar Lars Persson Committed by Steve French
Browse files

cifs: Fix use after free of a mid_q_entry 



With protocol version 2.0 mounts we have seen crashes with corrupt mid
entries. Either the server->pending_mid_q list becomes corrupt with a
cyclic reference in one element or a mid object fetched by the
demultiplexer thread becomes overwritten during use.

Code review identified a race between the demultiplexer thread and the
request issuing thread. The demultiplexer thread seems to be written
with the assumption that it is the sole user of the mid object until
it calls the mid callback which either wakes the issuer task or
deletes the mid.

This assumption is not true because the issuer task can be woken up
earlier by a signal. If the demultiplexer thread has proceeded as far
as setting the mid_state to MID_RESPONSE_RECEIVED then the issuer
thread will happily end up calling cifs_delete_mid while the
demultiplexer thread still is using the mid object.

Inserting a delay in the cifs demultiplexer thread widens the race
window and makes reproduction of the race very easy:

		if (server->large_buf)
			buf = server->bigbuf;

+		usleep_range(500, 4000);

		server->lstrp = jiffies;

To resolve this I think the proper solution involves putting a
reference count on the mid object. This patch makes sure that the
demultiplexer thread holds a reference until it has finished
processing the transaction.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarLars Persson <larper@axis.com>
Acked-by: default avatarPaulo Alcantara <palcantara@suse.de>
Reviewed-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
Reviewed-by: default avatarPavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 06c85639

fs/cifs/cifsglob.h

+1 −0
Original line number Diff line number Diff line
@@ -1416,6 +1416,7 @@ typedef int (mid_handle_t)(struct TCP_Server_Info *server, 
/* one of these for every pending CIFS request to the server */

struct mid_q_entry {

	struct list_head qhead;	/* mids waiting on reply from this server */

	struct kref refcount;

	struct TCP_Server_Info *server;	/* server corresponding to this mid */

	__u64 mid;		/* multiplex id */

	__u32 pid;		/* process id */

fs/cifs/cifsproto.h

+1 −0
Original line number Diff line number Diff line
@@ -82,6 +82,7 @@ extern struct mid_q_entry *AllocMidQEntry(const struct smb_hdr *smb_buffer, 
					struct TCP_Server_Info *server);

extern void DeleteMidQEntry(struct mid_q_entry *midEntry);

extern void cifs_delete_mid(struct mid_q_entry *mid);

extern void cifs_mid_q_entry_release(struct mid_q_entry *midEntry);

extern void cifs_wake_up_task(struct mid_q_entry *mid);

extern int cifs_handle_standard(struct TCP_Server_Info *server,

				struct mid_q_entry *mid);

fs/cifs/connect.c

+7 −1
Original line number Diff line number Diff line
@@ -924,6 +924,7 @@ next_pdu: 
				server->pdu_size = next_offset;

		}



		mid_entry = NULL;

		if (server->ops->is_transform_hdr &&

		    server->ops->receive_transform &&

		    server->ops->is_transform_hdr(buf)) {
@@ -938,8 +939,11 @@ next_pdu: 
				length = mid_entry->receive(server, mid_entry);

		}



		if (length < 0)

		if (length < 0) {

			if (mid_entry)

				cifs_mid_q_entry_release(mid_entry);

			continue;

		}



		if (server->large_buf)

			buf = server->bigbuf;
@@ -956,6 +960,8 @@ next_pdu: 


			if (!mid_entry->multiRsp || mid_entry->multiEnd)

				mid_entry->callback(mid_entry);



			cifs_mid_q_entry_release(mid_entry);

		} else if (server->ops->is_oplock_break &&

			   server->ops->is_oplock_break(buf, server)) {

			cifs_dbg(FYI, "Received oplock break\n");

fs/cifs/smb1ops.c

+1 −0
Original line number Diff line number Diff line
@@ -107,6 +107,7 @@ cifs_find_mid(struct TCP_Server_Info *server, char *buffer) 
		if (compare_mid(mid->mid, buf) &&

		    mid->mid_state == MID_REQUEST_SUBMITTED &&

		    le16_to_cpu(mid->command) == buf->Command) {

			kref_get(&mid->refcount);

			spin_unlock(&GlobalMid_Lock);

			return mid;

		}

fs/cifs/smb2ops.c

+1 −0
Original line number Diff line number Diff line
@@ -203,6 +203,7 @@ smb2_find_mid(struct TCP_Server_Info *server, char *buf) 
		if ((mid->mid == wire_mid) &&

		    (mid->mid_state == MID_REQUEST_SUBMITTED) &&

		    (mid->command == shdr->Command)) {

			kref_get(&mid->refcount);

			spin_unlock(&GlobalMid_Lock);

			return mid;

		}

CRA Git | Maintained and supported by SUSTech CRA and CCSE