Commit 87465346 authored Oct 19, 2023 by Namjae Jeon Committed by ZhaoLong Wang Oct 19, 2023

ksmbd: fix racy issue under cocurrent smb2 tree disconnect

mainline inclusion
from mainline-v6.4-rc1
commit 30210947
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I74FJA
CVE: CVE-2023-32254

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=30210947a343b6b3ca13adc9bfc88e1543e16dd5



--------------------------------

There is UAF issue under cocurrent smb2 tree disconnect.
This patch introduce TREE_CONN_EXPIRE flags for tcon to avoid cocurrent
access.

Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20592
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com>

parent 9358e1f4

fs/ksmbd/mgmt/tree_connect.c

+9 −1

Original line number	Diff line number	Diff line
		@@ -95,7 +95,15 @@ int ksmbd_tree_conn_disconnect(struct ksmbd_session *sess,
		struct ksmbd_tree_connect ksmbd_tree_conn_lookup(struct ksmbd_session sess,
		unsigned int id)
		{
		return xa_load(&sess->tree_conns, id);
		struct ksmbd_tree_connect *tcon;

		tcon = xa_load(&sess->tree_conns, id);
		if (tcon) {
		if (test_bit(TREE_CONN_EXPIRE, &tcon->status))
		tcon = NULL;
		}

		return tcon;
		}

		struct ksmbd_share_config ksmbd_tree_conn_share(struct ksmbd_session sess,

fs/ksmbd/mgmt/tree_connect.h

+3 −0

Original line number	Diff line number	Diff line
		@@ -14,6 +14,8 @@ struct ksmbd_share_config;
		struct ksmbd_user;
		struct ksmbd_conn;

		#define TREE_CONN_EXPIRE 1

		struct ksmbd_tree_connect {
		int id;

		@@ -25,6 +27,7 @@ struct ksmbd_tree_connect {

		int maximal_access;
		bool posix_extensions;
		unsigned long status;
		};

		struct ksmbd_tree_conn_status {

fs/ksmbd/smb2pdu.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -2101,11 +2101,12 @@ int smb2_tree_disconnect(struct ksmbd_work *work)

		ksmbd_debug(SMB, "request\n");

		if (!tcon) {
		if (!tcon \|\| test_and_set_bit(TREE_CONN_EXPIRE, &tcon->status)) {
		struct smb2_tree_disconnect_req *req =
		smb2_get_msg(work->request_buf);

		ksmbd_debug(SMB, "Invalid tid %d\n", req->hdr.Id.SyncId.TreeId);

		rsp->hdr.Status = STATUS_NETWORK_NAME_DELETED;
		smb2_set_err_rsp(work);
		return 0;