releases/5.0.10/cifs-fix-use-after-free-in-smb2_read.patch

   1 From 088aaf17aa79300cab14dbee2569c58cfafd7d6e Mon Sep 17 00:00:00 2001
   2 From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
   3 Date: Sat, 6 Apr 2019 15:47:39 +0800
   4 Subject: cifs: Fix use-after-free in SMB2_read
   5
   6 From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
   7
   8 commit 088aaf17aa79300cab14dbee2569c58cfafd7d6e upstream.
   9
  10 There is a KASAN use-after-free:
  11 BUG: KASAN: use-after-free in SMB2_read+0x1136/0x1190
  12 Read of size 8 at addr ffff8880b4e45e50 by task ln/1009
  13
  14 Should not release the 'req' because it will use in the trace.
  15
  16 Fixes: eccb4422cf97 ("smb3: Add ftrace tracepoints for improved SMB3 debugging")
  17
  18 Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
  19 Signed-off-by: Steve French <stfrench@microsoft.com>
  20 CC: Stable <stable@vger.kernel.org> 4.18+
  21 Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23
  24 ---
  25  fs/cifs/smb2pdu.c |    4 ++--
  26  1 file changed, 2 insertions(+), 2 deletions(-)
  27
  28 --- a/fs/cifs/smb2pdu.c
  29 +++ b/fs/cifs/smb2pdu.c
  30 @@ -3390,8 +3390,6 @@ SMB2_read(const unsigned int xid, struct
  31         rqst.rq_nvec = 1;
  32
  33         rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
  34 -       cifs_small_buf_release(req);
  35 -
  36         rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
  37
  38         if (rc) {
  39 @@ -3410,6 +3408,8 @@ SMB2_read(const unsigned int xid, struct
  40                                     io_parms->tcon->tid, ses->Suid,
  41                                     io_parms->offset, io_parms->length);
  42
  43 +       cifs_small_buf_release(req);
  44 +
  45         *nbytes = le32_to_cpu(rsp->DataLength);
  46         if ((*nbytes > CIFS_MAX_MSGSIZE) ||
  47             (*nbytes > io_parms->length)) {