Commit 30210947 authored May 03, 2023 by Namjae Jeon Committed by Steve French May 03, 2023

ksmbd: fix racy issue under cocurrent smb2 tree disconnect



There is UAF issue under cocurrent smb2 tree disconnect.
This patch introduce TREE_CONN_EXPIRE flags for tcon to avoid cocurrent
access.

Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20592
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

parent abcc506a

fs/ksmbd/mgmt/tree_connect.c

+9 −1

Original line number	Diff line number	Diff line
		@@ -109,7 +109,15 @@ int ksmbd_tree_conn_disconnect(struct ksmbd_session *sess,
		struct ksmbd_tree_connect ksmbd_tree_conn_lookup(struct ksmbd_session sess,
		unsigned int id)
		{
		return xa_load(&sess->tree_conns, id);
		struct ksmbd_tree_connect *tcon;

		tcon = xa_load(&sess->tree_conns, id);
		if (tcon) {
		if (test_bit(TREE_CONN_EXPIRE, &tcon->status))
		tcon = NULL;
		}

		return tcon;
		}

		struct ksmbd_share_config ksmbd_tree_conn_share(struct ksmbd_session sess,

fs/ksmbd/mgmt/tree_connect.h

+3 −0

Original line number	Diff line number	Diff line
		@@ -14,6 +14,8 @@ struct ksmbd_share_config;
		struct ksmbd_user;
		struct ksmbd_conn;

		#define TREE_CONN_EXPIRE 1

		struct ksmbd_tree_connect {
		int id;

		@@ -25,6 +27,7 @@ struct ksmbd_tree_connect {

		int maximal_access;
		bool posix_extensions;
		unsigned long status;
		};

		struct ksmbd_tree_conn_status {

fs/ksmbd/smb2pdu.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -2053,11 +2053,12 @@ int smb2_tree_disconnect(struct ksmbd_work *work)

		ksmbd_debug(SMB, "request\n");

		if (!tcon) {
		if (!tcon \|\| test_and_set_bit(TREE_CONN_EXPIRE, &tcon->status)) {
		struct smb2_tree_disconnect_req *req =
		smb2_get_msg(work->request_buf);

		ksmbd_debug(SMB, "Invalid tid %d\n", req->hdr.Id.SyncId.TreeId);

		rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED;
		smb2_set_err_rsp(work);
		return 0;