queue-4.19/cifs-fix-use-after-free-in-smb2_write.patch

   1 From 6a3eb3360667170988f8a6477f6686242061488a Mon Sep 17 00:00:00 2001
   2 From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
   3 Date: Sat, 6 Apr 2019 15:47:38 +0800
   4 Subject: cifs: Fix use-after-free in SMB2_write
   5
   6 From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
   7
   8 commit 6a3eb3360667170988f8a6477f6686242061488a upstream.
   9
  10 There is a KASAN use-after-free:
  11 BUG: KASAN: use-after-free in SMB2_write+0x1342/0x1580
  12 Read of size 8 at addr ffff8880b6a8e450 by task ln/4196
  13
  14 Should not release the 'req' because it will use in the trace.
  15
  16 Fixes: eccb4422cf97 ("smb3: Add ftrace tracepoints for improved SMB3 debugging")
  17
  18 Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
  19 Signed-off-by: Steve French <stfrench@microsoft.com>
  20 CC: Stable <stable@vger.kernel.org> 4.18+
  21 Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23
  24 ---
  25  fs/cifs/smb2pdu.c |    2 +-
  26  1 file changed, 1 insertion(+), 1 deletion(-)
  27
  28 --- a/fs/cifs/smb2pdu.c
  29 +++ b/fs/cifs/smb2pdu.c
  30 @@ -3591,7 +3591,6 @@ SMB2_write(const unsigned int xid, struc
  31
  32         rc = cifs_send_recv(xid, io_parms->tcon->ses, &rqst,
  33                             &resp_buftype, flags, &rsp_iov);
  34 -       cifs_small_buf_release(req);
  35         rsp = (struct smb2_write_rsp *)rsp_iov.iov_base;
  36
  37         if (rc) {
  38 @@ -3609,6 +3608,7 @@ SMB2_write(const unsigned int xid, struc
  39                                      io_parms->offset, *nbytes);
  40         }
  41
  42 +       cifs_small_buf_release(req);
  43         free_rsp_buf(resp_buftype, rsp);
  44         return rc;
  45  }