From d40b88aad5de395372616a965de2138af5caba0f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 15 Dec 2024 10:28:15 +0100 Subject: [PATCH] 6.1-stable patches added patches: exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch exfat-support-dynamic-allocate-bh-for-exfat_entry_set_cache.patch smb-client-fix-uaf-in-smb2_reconnect_server.patch --- ...l-deadlock-on-__exfat_get_dentry_set.patch | 58 +++++ ...llocate-bh-for-exfat_entry_set_cache.patch | 84 ++++++++ queue-6.1/series | 3 + ...ent-fix-uaf-in-smb2_reconnect_server.patch | 200 ++++++++++++++++++ 4 files changed, 345 insertions(+) create mode 100644 queue-6.1/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch create mode 100644 queue-6.1/exfat-support-dynamic-allocate-bh-for-exfat_entry_set_cache.patch create mode 100644 queue-6.1/smb-client-fix-uaf-in-smb2_reconnect_server.patch diff --git a/queue-6.1/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch b/queue-6.1/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch new file mode 100644 index 00000000000..2ba53f6c59a --- /dev/null +++ b/queue-6.1/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch @@ -0,0 +1,58 @@ +From 89fc548767a2155231128cb98726d6d2ea1256c9 Mon Sep 17 00:00:00 2001 +From: Sungjong Seo +Date: Fri, 31 May 2024 19:14:44 +0900 +Subject: exfat: fix potential deadlock on __exfat_get_dentry_set + +From: Sungjong Seo + +commit 89fc548767a2155231128cb98726d6d2ea1256c9 upstream. + +When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array +is allocated in __exfat_get_entry_set. The problem is that the bh-array is +allocated with GFP_KERNEL. It does not make sense. In the following cases, +a deadlock for sbi->s_lock between the two processes may occur. + + CPU0 CPU1 + ---- ---- + kswapd + balance_pgdat + lock(fs_reclaim) + exfat_iterate + lock(&sbi->s_lock) + exfat_readdir + exfat_get_uniname_from_ext_entry + exfat_get_dentry_set + __exfat_get_dentry_set + kmalloc_array + ... + lock(fs_reclaim) + ... + evict + exfat_evict_inode + lock(&sbi->s_lock) + +To fix this, let's allocate bh-array with GFP_NOFS. + +Fixes: a3ff29a95fde ("exfat: support dynamic allocate bh for exfat_entry_set_cache") +Cc: stable@vger.kernel.org # v6.2+ +Reported-by: syzbot+412a392a2cd4a65e71db@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/lkml/000000000000fef47e0618c0327f@google.com +Signed-off-by: Sungjong Seo +Signed-off-by: Namjae Jeon +Signed-off-by: Harshit Mogalapalli +Signed-off-by: Greg Kroah-Hartman +--- + fs/exfat/dir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/exfat/dir.c ++++ b/fs/exfat/dir.c +@@ -870,7 +870,7 @@ struct exfat_entry_set_cache *exfat_get_ + + num_bh = EXFAT_B_TO_BLK_ROUND_UP(off + num_entries * DENTRY_SIZE, sb); + if (num_bh > ARRAY_SIZE(es->__bh)) { +- es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_KERNEL); ++ es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_NOFS); + if (!es->bh) { + brelse(bh); + kfree(es); diff --git a/queue-6.1/exfat-support-dynamic-allocate-bh-for-exfat_entry_set_cache.patch b/queue-6.1/exfat-support-dynamic-allocate-bh-for-exfat_entry_set_cache.patch new file mode 100644 index 00000000000..5c528b27011 --- /dev/null +++ b/queue-6.1/exfat-support-dynamic-allocate-bh-for-exfat_entry_set_cache.patch @@ -0,0 +1,84 @@ +From a3ff29a95fde16906304455aa8c0bd84eb770258 Mon Sep 17 00:00:00 2001 +From: Yuezhang Mo +Date: Wed, 9 Nov 2022 13:50:22 +0800 +Subject: exfat: support dynamic allocate bh for exfat_entry_set_cache + +From: Yuezhang Mo + +commit a3ff29a95fde16906304455aa8c0bd84eb770258 upstream. + +In special cases, a file or a directory may occupied more than 19 +directory entries, pre-allocating 3 bh is not enough. Such as + - Support vendor secondary directory entry in the future. + - Since file directory entry is damaged, the SecondaryCount + field is bigger than 18. + +So this commit supports dynamic allocation of bh. + +Signed-off-by: Yuezhang Mo +Reviewed-by: Andy Wu +Reviewed-by: Aoyama Wataru +Reviewed-by: Sungjong Seo +Signed-off-by: Namjae Jeon +Signed-off-by: Harshit Mogalapalli +Signed-off-by: Greg Kroah-Hartman +--- + fs/exfat/dir.c | 15 +++++++++++++++ + fs/exfat/exfat_fs.h | 5 ++++- + 2 files changed, 19 insertions(+), 1 deletion(-) + +--- a/fs/exfat/dir.c ++++ b/fs/exfat/dir.c +@@ -613,6 +613,10 @@ int exfat_free_dentry_set(struct exfat_e + bforget(es->bh[i]); + else + brelse(es->bh[i]); ++ ++ if (IS_DYNAMIC_ES(es)) ++ kfree(es->bh); ++ + kfree(es); + return err; + } +@@ -845,6 +849,7 @@ struct exfat_entry_set_cache *exfat_get_ + /* byte offset in sector */ + off = EXFAT_BLK_OFFSET(byte_offset, sb); + es->start_off = off; ++ es->bh = es->__bh; + + /* sector offset in cluster */ + sec = EXFAT_B_TO_BLK(byte_offset, sb); +@@ -864,6 +869,16 @@ struct exfat_entry_set_cache *exfat_get_ + es->num_entries = num_entries; + + num_bh = EXFAT_B_TO_BLK_ROUND_UP(off + num_entries * DENTRY_SIZE, sb); ++ if (num_bh > ARRAY_SIZE(es->__bh)) { ++ es->bh = kmalloc_array(num_bh, sizeof(*es->bh), GFP_KERNEL); ++ if (!es->bh) { ++ brelse(bh); ++ kfree(es); ++ return NULL; ++ } ++ es->bh[0] = bh; ++ } ++ + for (i = 1; i < num_bh; i++) { + /* get the next sector */ + if (exfat_is_last_sector_in_cluster(sbi, sec)) { +--- a/fs/exfat/exfat_fs.h ++++ b/fs/exfat/exfat_fs.h +@@ -169,10 +169,13 @@ struct exfat_entry_set_cache { + bool modified; + unsigned int start_off; + int num_bh; +- struct buffer_head *bh[DIR_CACHE_SIZE]; ++ struct buffer_head *__bh[DIR_CACHE_SIZE]; ++ struct buffer_head **bh; + unsigned int num_entries; + }; + ++#define IS_DYNAMIC_ES(es) ((es)->__bh != (es)->bh) ++ + struct exfat_dir_entry { + struct exfat_chain dir; + int entry; diff --git a/queue-6.1/series b/queue-6.1/series index 48ff6b3261d..b917bb80d5d 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -22,3 +22,6 @@ xfs-fix-scrub-tracepoints-when-inode-rooted-btrees-are-involved.patch xfs-only-run-precommits-once-per-transaction-object.patch bpf-perf-fix-invalid-prog_array-access-in-perf_event_detach_bpf_prog.patch bpf-sockmap-fix-update-element-with-same.patch +smb-client-fix-uaf-in-smb2_reconnect_server.patch +exfat-support-dynamic-allocate-bh-for-exfat_entry_set_cache.patch +exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch diff --git a/queue-6.1/smb-client-fix-uaf-in-smb2_reconnect_server.patch b/queue-6.1/smb-client-fix-uaf-in-smb2_reconnect_server.patch new file mode 100644 index 00000000000..3a28fe881c5 --- /dev/null +++ b/queue-6.1/smb-client-fix-uaf-in-smb2_reconnect_server.patch @@ -0,0 +1,200 @@ +From 24a9799aa8efecd0eb55a75e35f9d8e6400063aa Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Mon, 1 Apr 2024 14:13:10 -0300 +Subject: smb: client: fix UAF in smb2_reconnect_server() + +From: Paulo Alcantara + +commit 24a9799aa8efecd0eb55a75e35f9d8e6400063aa upstream. + +The UAF bug is due to smb2_reconnect_server() accessing a session that +is already being teared down by another thread that is executing +__cifs_put_smb_ses(). This can happen when (a) the client has +connection to the server but no session or (b) another thread ends up +setting @ses->ses_status again to something different than +SES_EXITING. + +To fix this, we need to make sure to unconditionally set +@ses->ses_status to SES_EXITING and prevent any other threads from +setting a new status while we're still tearing it down. + +The following can be reproduced by adding some delay to right after +the ipc is freed in __cifs_put_smb_ses() - which will give +smb2_reconnect_server() worker a chance to run and then accessing +@ses->ipc: + +kinit ... +mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10 +[disconnect srv] +ls /mnt/1 &>/dev/null +sleep 30 +kdestroy +[reconnect srv] +sleep 10 +umount /mnt/1 +... +CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed +CIFS: VFS: \\srv Send error in SessSetup = -126 +CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed +CIFS: VFS: \\srv Send error in SessSetup = -126 +general protection fault, probably for non-canonical address +0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI +CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 +04/01/2014 +Workqueue: cifsiod smb2_reconnect_server [cifs] +RIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0 +Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad +de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75 +7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8 +RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83 +RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b +RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800 +RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000 +R13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000 +FS: 0000000000000000(0000) GS:ffff888157c00000(0000) +knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0 +PKRU: 55555554 +Call Trace: + + ? die_addr+0x36/0x90 + ? exc_general_protection+0x1c1/0x3f0 + ? asm_exc_general_protection+0x26/0x30 + ? __list_del_entry_valid_or_report+0x33/0xf0 + __cifs_put_smb_ses+0x1ae/0x500 [cifs] + smb2_reconnect_server+0x4ed/0x710 [cifs] + process_one_work+0x205/0x6b0 + worker_thread+0x191/0x360 + ? __pfx_worker_thread+0x10/0x10 + kthread+0xe2/0x110 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x34/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1a/0x30 + + +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +[ Michael Krause: Naive, manual merge because the 3rd hunk would not apply. ] +Signed-off-by: Michael Krause +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/connect.c | 78 ++++++++++++++++++++---------------------------- + 1 file changed, 34 insertions(+), 44 deletions(-) + +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -259,7 +259,13 @@ cifs_mark_tcp_ses_conns_for_reconnect(st + + spin_lock(&cifs_tcp_ses_lock); + list_for_each_entry_safe(ses, nses, &pserver->smb_ses_list, smb_ses_list) { +- /* check if iface is still active */ ++ spin_lock(&ses->ses_lock); ++ if (ses->ses_status == SES_EXITING) { ++ spin_unlock(&ses->ses_lock); ++ continue; ++ } ++ spin_unlock(&ses->ses_lock); ++ + spin_lock(&ses->chan_lock); + if (!cifs_chan_is_iface_active(ses, server)) { + spin_unlock(&ses->chan_lock); +@@ -1977,31 +1983,6 @@ out: + return rc; + } + +-/** +- * cifs_free_ipc - helper to release the session IPC tcon +- * @ses: smb session to unmount the IPC from +- * +- * Needs to be called everytime a session is destroyed. +- * +- * On session close, the IPC is closed and the server must release all tcons of the session. +- * No need to send a tree disconnect here. +- * +- * Besides, it will make the server to not close durable and resilient files on session close, as +- * specified in MS-SMB2 3.3.5.6 Receiving an SMB2 LOGOFF Request. +- */ +-static int +-cifs_free_ipc(struct cifs_ses *ses) +-{ +- struct cifs_tcon *tcon = ses->tcon_ipc; +- +- if (tcon == NULL) +- return 0; +- +- tconInfoFree(tcon); +- ses->tcon_ipc = NULL; +- return 0; +-} +- + static struct cifs_ses * + cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx) + { +@@ -2035,35 +2016,44 @@ void cifs_put_smb_ses(struct cifs_ses *s + { + unsigned int rc, xid; + unsigned int chan_count; ++ bool do_logoff; ++ struct cifs_tcon *tcon; + struct TCP_Server_Info *server = ses->server; + ++ spin_lock(&cifs_tcp_ses_lock); + spin_lock(&ses->ses_lock); +- if (ses->ses_status == SES_EXITING) { ++ cifs_dbg(FYI, "%s: id=0x%llx ses_count=%d ses_status=%u ipc=%s\n", ++ __func__, ses->Suid, ses->ses_count, ses->ses_status, ++ ses->tcon_ipc ? ses->tcon_ipc->tree_name : "none"); ++ if (ses->ses_status == SES_EXITING || --ses->ses_count > 0) { + spin_unlock(&ses->ses_lock); +- return; +- } +- spin_unlock(&ses->ses_lock); +- +- cifs_dbg(FYI, "%s: ses_count=%d\n", __func__, ses->ses_count); +- cifs_dbg(FYI, +- "%s: ses ipc: %s\n", __func__, ses->tcon_ipc ? ses->tcon_ipc->tree_name : "NONE"); +- +- spin_lock(&cifs_tcp_ses_lock); +- if (--ses->ses_count > 0) { + spin_unlock(&cifs_tcp_ses_lock); + return; + } +- spin_unlock(&cifs_tcp_ses_lock); +- + /* ses_count can never go negative */ + WARN_ON(ses->ses_count < 0); + +- if (ses->ses_status == SES_GOOD) +- ses->ses_status = SES_EXITING; +- +- cifs_free_ipc(ses); ++ spin_lock(&ses->chan_lock); ++ cifs_chan_clear_need_reconnect(ses, server); ++ spin_unlock(&ses->chan_lock); ++ ++ do_logoff = ses->ses_status == SES_GOOD && server->ops->logoff; ++ ses->ses_status = SES_EXITING; ++ tcon = ses->tcon_ipc; ++ ses->tcon_ipc = NULL; ++ spin_unlock(&ses->ses_lock); ++ spin_unlock(&cifs_tcp_ses_lock); + +- if (ses->ses_status == SES_EXITING && server->ops->logoff) { ++ /* ++ * On session close, the IPC is closed and the server must release all ++ * tcons of the session. No need to send a tree disconnect here. ++ * ++ * Besides, it will make the server to not close durable and resilient ++ * files on session close, as specified in MS-SMB2 3.3.5.6 Receiving an ++ * SMB2 LOGOFF Request. ++ */ ++ tconInfoFree(tcon); ++ if (do_logoff) { + xid = get_xid(); + rc = server->ops->logoff(xid, ses); + if (rc) -- 2.47.2