Unverified Commit bf2976e5 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6112 cifs: Fix UAF in cifs_demultiplex_thread() 

Merge Pull Request from: @ci-robot 
 
PR sync from: ZhaoLong Wang <wangzhaolong1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ATT6QNPTDSLDKGSU2K74F53RV766DEHI/ 
 
https://gitee.com/src-openeuler/kernel/issues/I95AUA 
 
Link:https://gitee.com/openeuler/kernel/pulls/6112

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents a474d353 d7031dce

fs/cifs/cifsglob.h

+1 −0
Original line number Diff line number Diff line
@@ -1768,6 +1768,7 @@ static inline bool is_retryable_error(int error) 
#define   MID_RETRY_NEEDED      8 /* session closed while this request out */

#define   MID_RESPONSE_MALFORMED 0x10

#define   MID_SHUTDOWN		 0x20

#define   MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */



/* Flags */

#define   MID_WAIT_CANCELLED	 1 /* Cancelled while waiting for response */

fs/cifs/transport.c

+23 −11
Original line number Diff line number Diff line
@@ -47,6 +47,8 @@ 
void

cifs_wake_up_task(struct mid_q_entry *mid)

{

	if (mid->mid_state == MID_RESPONSE_RECEIVED)

		mid->mid_state = MID_RESPONSE_READY;

	wake_up_process(mid->callback_data);

}
@@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) 
	struct TCP_Server_Info *server = midEntry->server;



	if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) &&

	    midEntry->mid_state == MID_RESPONSE_RECEIVED &&

	    (midEntry->mid_state == MID_RESPONSE_RECEIVED ||

	     midEntry->mid_state == MID_RESPONSE_READY) &&

	    server->ops->handle_cancelled_mid)

		server->ops->handle_cancelled_mid(midEntry, server);
@@ -733,7 +736,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) 
	int error;



	error = wait_event_freezekillable_unsafe(server->response_q,

				    midQ->mid_state != MID_REQUEST_SUBMITTED);

				    midQ->mid_state != MID_REQUEST_SUBMITTED &&

				    midQ->mid_state != MID_RESPONSE_RECEIVED);

	if (error < 0)

		return -ERESTARTSYS;
@@ -885,7 +889,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) 


	spin_lock(&GlobalMid_Lock);

	switch (mid->mid_state) {

	case MID_RESPONSE_RECEIVED:

	case MID_RESPONSE_READY:

		spin_unlock(&GlobalMid_Lock);

		return rc;

	case MID_RETRY_NEEDED:
@@ -984,6 +988,9 @@ cifs_compound_callback(struct mid_q_entry *mid) 
	credits.instance = server->reconnect_instance;



	add_credits(server, &credits, mid->optype);



	if (mid->mid_state == MID_RESPONSE_RECEIVED)

		mid->mid_state = MID_RESPONSE_READY;

}



static void
@@ -1172,7 +1179,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, 
			send_cancel(server, &rqst[i], midQ[i]);

			spin_lock(&GlobalMid_Lock);

			midQ[i]->mid_flags |= MID_WAIT_CANCELLED;

			if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) {

			if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED ||

			    midQ[i]->mid_state == MID_RESPONSE_RECEIVED) {

				midQ[i]->callback = cifs_cancelled_callback;

				cancelled_mid[i] = true;

				credits[i].value = 0;
@@ -1193,7 +1201,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, 
		}



		if (!midQ[i]->resp_buf ||

		    midQ[i]->mid_state != MID_RESPONSE_RECEIVED) {

		    midQ[i]->mid_state != MID_RESPONSE_READY) {

			rc = -EIO;

			cifs_dbg(FYI, "Bad MID state?\n");

			goto out;
@@ -1372,7 +1380,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, 
	if (rc != 0) {

		send_cancel(server, &rqst, midQ);

		spin_lock(&GlobalMid_Lock);

		if (midQ->mid_state == MID_REQUEST_SUBMITTED) {

		if (midQ->mid_state == MID_REQUEST_SUBMITTED ||

		    midQ->mid_state == MID_RESPONSE_RECEIVED) {

			/* no longer considered to be "in-flight" */

			midQ->callback = DeleteMidQEntry;

			spin_unlock(&GlobalMid_Lock);
@@ -1389,7 +1398,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, 
	}



	if (!midQ->resp_buf || !out_buf ||

	    midQ->mid_state != MID_RESPONSE_RECEIVED) {

	    midQ->mid_state != MID_RESPONSE_READY) {

		rc = -EIO;

		cifs_server_dbg(VFS, "Bad MID state?\n");

		goto out;
@@ -1509,13 +1518,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, 


	/* Wait for a reply - allow signals to interrupt. */

	rc = wait_event_interruptible(server->response_q,

		(!(midQ->mid_state == MID_REQUEST_SUBMITTED)) ||

		(!(midQ->mid_state == MID_REQUEST_SUBMITTED ||

		   midQ->mid_state == MID_RESPONSE_RECEIVED)) ||

		((server->tcpStatus != CifsGood) &&

		 (server->tcpStatus != CifsNew)));



	/* Were we interrupted by a signal ? */

	if ((rc == -ERESTARTSYS) &&

		(midQ->mid_state == MID_REQUEST_SUBMITTED) &&

		(midQ->mid_state == MID_REQUEST_SUBMITTED ||

		 midQ->mid_state == MID_RESPONSE_RECEIVED) &&

		((server->tcpStatus == CifsGood) ||

		 (server->tcpStatus == CifsNew))) {
@@ -1545,7 +1556,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, 
		if (rc) {

			send_cancel(server, &rqst, midQ);

			spin_lock(&GlobalMid_Lock);

			if (midQ->mid_state == MID_REQUEST_SUBMITTED) {

			if (midQ->mid_state == MID_REQUEST_SUBMITTED ||

			    midQ->mid_state == MID_RESPONSE_RECEIVED) {

				/* no longer considered to be "in-flight" */

				midQ->callback = DeleteMidQEntry;

				spin_unlock(&GlobalMid_Lock);
@@ -1563,7 +1575,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, 
		return rc;



	/* rcvd frame is ok */

	if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) {

	if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) {

		rc = -EIO;

		cifs_tcon_dbg(VFS, "Bad MID state?\n");

		goto out;