Unverified Commit 7cb2e2ed authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12682 smb: client: fix UAF in async decryption 

Merge Pull Request from: @ci-robot 
 
PR sync from: Long Li <leo.lilong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5PWZDTYIMSXEYHIVG5WEJ2WUO2TWEEOK/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYRE5 
 
Link:https://gitee.com/openeuler/kernel/pulls/12682

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 93af945a c7abcd26

fs/smb/client/smb2ops.c

+28 −19
Original line number Diff line number Diff line
@@ -4245,7 +4245,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key) 
 */

static int

crypt_message(struct TCP_Server_Info *server, int num_rqst,

	      struct smb_rqst *rqst, int enc)

	      struct smb_rqst *rqst, int enc, struct crypto_aead *tfm)

{

	struct smb2_transform_hdr *tr_hdr =

		(struct smb2_transform_hdr *)rqst[0].rq_iov[0].iov_base;
@@ -4256,8 +4256,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, 
	u8 key[SMB3_ENC_DEC_KEY_SIZE];

	struct aead_request *req;

	u8 *iv;

	DECLARE_CRYPTO_WAIT(wait);

	struct crypto_aead *tfm;

	unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);

	void *creq;

	size_t sensitive_size;
@@ -4269,14 +4267,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, 
		return rc;

	}



	rc = smb3_crypto_aead_allocate(server);

	if (rc) {

		cifs_server_dbg(VFS, "%s: crypto alloc failed\n", __func__);

		return rc;

	}



	tfm = enc ? server->secmech.enc : server->secmech.dec;



	if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) ||

		(server->cipher_type == SMB2_ENCRYPTION_AES256_GCM))

		rc = crypto_aead_setkey(tfm, key, SMB3_GCM256_CRYPTKEY_SIZE);
@@ -4316,11 +4306,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, 
	aead_request_set_crypt(req, sg, sg, crypt_len, iv);

	aead_request_set_ad(req, assoc_data_len);



	aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,

				  crypto_req_done, &wait);



	rc = crypto_wait_req(enc ? crypto_aead_encrypt(req)

				: crypto_aead_decrypt(req), &wait);

	rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);



	if (!rc && enc)

		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
@@ -4427,7 +4413,7 @@ smb3_init_transform_rq(struct TCP_Server_Info *server, int num_rqst, 
	/* fill the 1st iov with a transform header */

	fill_transform_hdr(tr_hdr, orig_len, old_rq, server->cipher_type);



	rc = crypt_message(server, num_rqst, new_rq, 1);

	rc = crypt_message(server, num_rqst, new_rq, 1, server->secmech.enc);

	cifs_dbg(FYI, "Encrypt message returned %d\n", rc);

	if (rc)

		goto err_free;
@@ -4452,8 +4438,9 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, 
		 unsigned int buf_data_size, struct iov_iter *iter,

		 bool is_offloaded)

{

	struct kvec iov[2];

	struct crypto_aead *tfm;

	struct smb_rqst rqst = {NULL};

	struct kvec iov[2];

	size_t iter_size = 0;

	int rc;
@@ -4470,9 +4457,31 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, 
		iter_size = iov_iter_count(iter);

	}



	rc = crypt_message(server, 1, &rqst, 0);

	if (is_offloaded) {

		if ((server->cipher_type == SMB2_ENCRYPTION_AES128_GCM) ||

		    (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM))

			tfm = crypto_alloc_aead("gcm(aes)", 0, 0);

		else

			tfm = crypto_alloc_aead("ccm(aes)", 0, 0);

		if (IS_ERR(tfm)) {

			rc = PTR_ERR(tfm);

			cifs_server_dbg(VFS, "%s: Failed alloc decrypt TFM, rc=%d\n", __func__, rc);



			return rc;

		}

	} else {

		if (unlikely(!server->secmech.dec))

			return -EIO;



		tfm = server->secmech.dec;

	}



	rc = crypt_message(server, 1, &rqst, 0, tfm);

	cifs_dbg(FYI, "Decrypt message returned %d\n", rc);



	if (is_offloaded)

		crypto_free_aead(tfm);



	if (rc)

		return rc;

fs/smb/client/smb2pdu.c

+6 −0
Original line number Diff line number Diff line
@@ -1263,6 +1263,12 @@ SMB2_negotiate(const unsigned int xid, 
		else

			cifs_server_dbg(VFS, "Missing expected negotiate contexts\n");

	}



	if (server->cipher_type && !rc) {

		rc = smb3_crypto_aead_allocate(server);

		if (rc)

			cifs_server_dbg(VFS, "%s: crypto alloc failed, rc=%d\n", __func__, rc);

	}

neg_exit:

	free_rsp_buf(resp_buftype, rsp);

	return rc;