Commit ca837b4e authored by Namjae Jeon's avatar Namjae Jeon Committed by Zizhi Wo
Browse files

ksmbd: delete asynchronous work from list 

mainline inclusion
from mainline-v6.3-rc6
commit 3a9b557f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6KEWO?from=project-issue
CVE: CVE-2023-1193

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3a9b557f44ea8f216aab515a7db20e23f0eb51b9



--------------------------------

When smb2_lock request is canceled by smb2_cancel or smb2_close(),
ksmbd is missing deleting async_request_entry async_requests list.
Because calling init_smb2_rsp_hdr() in smb2_lock() mark ->synchronous
as true and then it will not be deleted in
ksmbd_conn_try_dequeue_request(). This patch add release_async_work() to
release the ones allocated for async work.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
Signed-off-by: default avatarZizhi Wo <wozizhi@huawei.com>
parent e62091e6

fs/ksmbd/connection.c

+5 −7
Original line number Diff line number Diff line
@@ -106,10 +106,8 @@ void ksmbd_conn_enqueue_request(struct ksmbd_work *work) 
	struct ksmbd_conn *conn = work->conn;

	struct list_head *requests_queue = NULL;



	if (conn->ops->get_cmd_val(work) != SMB2_CANCEL_HE) {

	if (conn->ops->get_cmd_val(work) != SMB2_CANCEL_HE)

		requests_queue = &conn->requests;

		work->synchronous = true;

	}



	if (requests_queue) {

		atomic_inc(&conn->req_running);
@@ -130,14 +128,14 @@ int ksmbd_conn_try_dequeue_request(struct ksmbd_work *work) 


	if (!work->multiRsp)

		atomic_dec(&conn->req_running);

	spin_lock(&conn->request_lock);

	if (!work->multiRsp) {

		spin_lock(&conn->request_lock);

		list_del_init(&work->request_entry);

		if (!work->synchronous)

			list_del_init(&work->async_request_entry);

		spin_unlock(&conn->request_lock);

		if (work->asynchronous)

			release_async_work(work);

		ret = 0;

	}

	spin_unlock(&conn->request_lock);



	wake_up_all(&conn->req_running_q);

	return ret;

fs/ksmbd/ksmbd_work.h

+1 −1
Original line number Diff line number Diff line
@@ -68,7 +68,7 @@ struct ksmbd_work { 
	/* Request is encrypted */

	bool                            encrypted:1;

	/* Is this SYNC or ASYNC ksmbd_work */

	bool                            synchronous:1;

	bool                            asynchronous:1;

	bool                            need_invalidate_rkey:1;



	unsigned int                    remote_key;

fs/ksmbd/smb2pdu.c

+21 −12
Original line number Diff line number Diff line
@@ -519,12 +519,6 @@ int init_smb2_rsp_hdr(struct ksmbd_work *work) 
	rsp_hdr->SessionId = rcv_hdr->SessionId;

	memcpy(rsp_hdr->Signature, rcv_hdr->Signature, 16);



	work->synchronous = true;

	if (work->async_id) {

		ksmbd_release_id(&conn->async_ida, work->async_id);

		work->async_id = 0;

	}



	return 0;

}
@@ -682,7 +676,7 @@ int setup_async_work(struct ksmbd_work *work, void (*fn)(void **), void **arg) 
		pr_err("Failed to alloc async message id\n");

		return id;

	}

	work->synchronous = false;

	work->asynchronous = true;

	work->async_id = id;

	rsp_hdr->Id.AsyncId = cpu_to_le64(id);
@@ -702,6 +696,24 @@ int setup_async_work(struct ksmbd_work *work, void (*fn)(void **), void **arg) 
	return 0;

}



void release_async_work(struct ksmbd_work *work)

{

	struct ksmbd_conn *conn = work->conn;



	spin_lock(&conn->request_lock);

	list_del_init(&work->async_request_entry);

	spin_unlock(&conn->request_lock);



	work->asynchronous = 0;

	work->cancel_fn = NULL;

	kfree(work->cancel_argv);

	work->cancel_argv = NULL;

	if (work->async_id) {

		ksmbd_release_id(&conn->async_ida, work->async_id);

		work->async_id = 0;

	}

}



void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status)

{

	struct smb2_hdr *rsp_hdr;
@@ -7067,13 +7079,9 @@ int smb2_lock(struct ksmbd_work *work) 


				ksmbd_vfs_posix_lock_wait(flock);



				spin_lock(&work->conn->request_lock);

				spin_lock(&fp->f_lock);

				list_del(&work->fp_entry);

				work->cancel_fn = NULL;

				kfree(argv);

				spin_unlock(&fp->f_lock);

				spin_unlock(&work->conn->request_lock);



				if (work->state != KSMBD_WORK_ACTIVE) {

					list_del(&smb_lock->llist);
@@ -7091,6 +7099,7 @@ int smb2_lock(struct ksmbd_work *work) 
						work->send_no_response = 1;

						goto out;

					}



					init_smb2_rsp_hdr(work);

					smb2_set_err_rsp(work);

					rsp->hdr.Status =
@@ -7103,7 +7112,7 @@ int smb2_lock(struct ksmbd_work *work) 
				spin_lock(&work->conn->llist_lock);

				list_del(&smb_lock->clist);

				spin_unlock(&work->conn->llist_lock);



				release_async_work(work);

				goto retry;

			} else if (!rc) {

				spin_lock(&work->conn->llist_lock);

fs/ksmbd/smb2pdu.h

+1 −0
Original line number Diff line number Diff line
@@ -1664,6 +1664,7 @@ int find_matching_smb2_dialect(int start_index, __le16 *cli_dialects, 
struct file_lock *smb_flock_init(struct file *f);

int setup_async_work(struct ksmbd_work *work, void (*fn)(void **),

		     void **arg);

void release_async_work(struct ksmbd_work *work);

void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status);

struct channel *lookup_chann_list(struct ksmbd_session *sess,

				  struct ksmbd_conn *conn);