From: Greg Kroah-Hartman Date: Tue, 22 Apr 2025 09:45:55 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v6.1.135~55 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c81633c2f2e714e8fa69a76d1dfe689987b4ad04;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: smb-client-fix-use-after-free-of-network-namespace.patch --- diff --git a/queue-6.1/series b/queue-6.1/series index 45febb1eaa..2fdcde6912 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -276,3 +276,4 @@ drm-amd-display-stop-amdgpu_dm-initialize-when-link-nums-greater-than-max_links. landlock-add-the-errata-interface.patch revert-loongarch-bpf-fix-off-by-one-error-in-build_prologue.patch nvmet-fc-remove-unused-functions.patch +smb-client-fix-use-after-free-of-network-namespace.patch diff --git a/queue-6.1/smb-client-fix-use-after-free-of-network-namespace.patch b/queue-6.1/smb-client-fix-use-after-free-of-network-namespace.patch new file mode 100644 index 0000000000..728b2fb1e9 --- /dev/null +++ b/queue-6.1/smb-client-fix-use-after-free-of-network-namespace.patch @@ -0,0 +1,204 @@ +From ef7134c7fc48e1441b398e55a862232868a6f0a7 Mon Sep 17 00:00:00 2001 +From: Kuniyuki Iwashima +Date: Sat, 2 Nov 2024 14:24:38 -0700 +Subject: smb: client: Fix use-after-free of network namespace. + +From: Kuniyuki Iwashima + +commit ef7134c7fc48e1441b398e55a862232868a6f0a7 upstream. + +Recently, we got a customer report that CIFS triggers oops while +reconnecting to a server. [0] + +The workload runs on Kubernetes, and some pods mount CIFS servers +in non-root network namespaces. The problem rarely happened, but +it was always while the pod was dying. + +The root cause is wrong reference counting for network namespace. + +CIFS uses kernel sockets, which do not hold refcnt of the netns that +the socket belongs to. That means CIFS must ensure the socket is +always freed before its netns; otherwise, use-after-free happens. + +The repro steps are roughly: + + 1. mount CIFS in a non-root netns + 2. drop packets from the netns + 3. destroy the netns + 4. unmount CIFS + +We can reproduce the issue quickly with the script [1] below and see +the splat [2] if CONFIG_NET_NS_REFCNT_TRACKER is enabled. + +When the socket is TCP, it is hard to guarantee the netns lifetime +without holding refcnt due to async timers. + +Let's hold netns refcnt for each socket as done for SMC in commit +9744d2bf1976 ("smc: Fix use-after-free in tcp_write_timer_handler()."). + +Note that we need to move put_net() from cifs_put_tcp_session() to +clean_demultiplex_info(); otherwise, __sock_create() still could touch a +freed netns while cifsd tries to reconnect from cifs_demultiplex_thread(). + +Also, maybe_get_net() cannot be put just before __sock_create() because +the code is not under RCU and there is a small chance that the same +address happened to be reallocated to another netns. + +[0]: +CIFS: VFS: \\XXXXXXXXXXX has not responded in 15 seconds. Reconnecting... +CIFS: Serverclose failed 4 times, giving up +Unable to handle kernel paging request at virtual address 14de99e461f84a07 +Mem abort info: + ESR = 0x0000000096000004 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x04: level 0 translation fault +Data abort info: + ISV = 0, ISS = 0x00000004 + CM = 0, WnR = 0 +[14de99e461f84a07] address between user and kernel address ranges +Internal error: Oops: 0000000096000004 [#1] SMP +Modules linked in: cls_bpf sch_ingress nls_utf8 cifs cifs_arc4 cifs_md4 dns_resolver tcp_diag inet_diag veth xt_state xt_connmark nf_conntrack_netlink xt_nat xt_statistic xt_MASQUERADE xt_mark xt_addrtype ipt_REJECT nf_reject_ipv4 nft_chain_nat nf_nat xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_comment nft_compat nf_tables nfnetlink overlay nls_ascii nls_cp437 sunrpc vfat fat aes_ce_blk aes_ce_cipher ghash_ce sm4_ce_cipher sm4 sm3_ce sm3 sha3_ce sha512_ce sha512_arm64 sha1_ce ena button sch_fq_codel loop fuse configfs dmi_sysfs sha2_ce sha256_arm64 dm_mirror dm_region_hash dm_log dm_mod dax efivarfs +CPU: 5 PID: 2690970 Comm: cifsd Not tainted 6.1.103-109.184.amzn2023.aarch64 #1 +Hardware name: Amazon EC2 r7g.4xlarge/, BIOS 1.0 11/1/2018 +pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : fib_rules_lookup+0x44/0x238 +lr : __fib_lookup+0x64/0xbc +sp : ffff8000265db790 +x29: ffff8000265db790 x28: 0000000000000000 x27: 000000000000bd01 +x26: 0000000000000000 x25: ffff000b4baf8000 x24: ffff00047b5e4580 +x23: ffff8000265db7e0 x22: 0000000000000000 x21: ffff00047b5e4500 +x20: ffff0010e3f694f8 x19: 14de99e461f849f7 x18: 0000000000000000 +x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 +x14: 0000000000000000 x13: 0000000000000000 x12: 3f92800abd010002 +x11: 0000000000000001 x10: ffff0010e3f69420 x9 : ffff800008a6f294 +x8 : 0000000000000000 x7 : 0000000000000006 x6 : 0000000000000000 +x5 : 0000000000000001 x4 : ffff001924354280 x3 : ffff8000265db7e0 +x2 : 0000000000000000 x1 : ffff0010e3f694f8 x0 : ffff00047b5e4500 +Call trace: + fib_rules_lookup+0x44/0x238 + __fib_lookup+0x64/0xbc + ip_route_output_key_hash_rcu+0x2c4/0x398 + ip_route_output_key_hash+0x60/0x8c + tcp_v4_connect+0x290/0x488 + __inet_stream_connect+0x108/0x3d0 + inet_stream_connect+0x50/0x78 + kernel_connect+0x6c/0xac + generic_ip_connect+0x10c/0x6c8 [cifs] + __reconnect_target_unlocked+0xa0/0x214 [cifs] + reconnect_dfs_server+0x144/0x460 [cifs] + cifs_reconnect+0x88/0x148 [cifs] + cifs_readv_from_socket+0x230/0x430 [cifs] + cifs_read_from_socket+0x74/0xa8 [cifs] + cifs_demultiplex_thread+0xf8/0x704 [cifs] + kthread+0xd0/0xd4 +Code: aa0003f8 f8480f13 eb18027f 540006c0 (b9401264) + +[1]: +CIFS_CRED="/root/cred.cifs" +CIFS_USER="Administrator" +CIFS_PASS="Password" +CIFS_IP="X.X.X.X" +CIFS_PATH="//${CIFS_IP}/Users/Administrator/Desktop/CIFS_TEST" +CIFS_MNT="/mnt/smb" +DEV="enp0s3" + +cat < ${CIFS_CRED} +username=${CIFS_USER} +password=${CIFS_PASS} +domain=EXAMPLE.COM +EOF + +unshare -n bash -c " +mkdir -p ${CIFS_MNT} +ip netns attach root 1 +ip link add eth0 type veth peer veth0 netns root +ip link set eth0 up +ip -n root link set veth0 up +ip addr add 192.168.0.2/24 dev eth0 +ip -n root addr add 192.168.0.1/24 dev veth0 +ip route add default via 192.168.0.1 dev eth0 +ip netns exec root sysctl net.ipv4.ip_forward=1 +ip netns exec root iptables -t nat -A POSTROUTING -s 192.168.0.2 -o ${DEV} -j MASQUERADE +mount -t cifs ${CIFS_PATH} ${CIFS_MNT} -o vers=3.0,sec=ntlmssp,credentials=${CIFS_CRED},rsize=65536,wsize=65536,cache=none,echo_interval=1 +touch ${CIFS_MNT}/a.txt +ip netns exec root iptables -t nat -D POSTROUTING -s 192.168.0.2 -o ${DEV} -j MASQUERADE +" + +umount ${CIFS_MNT} + +[2]: +ref_tracker: net notrefcnt@000000004bbc008d has 1/1 users at + sk_alloc (./include/net/net_namespace.h:339 net/core/sock.c:2227) + inet_create (net/ipv4/af_inet.c:326 net/ipv4/af_inet.c:252) + __sock_create (net/socket.c:1576) + generic_ip_connect (fs/smb/client/connect.c:3075) + cifs_get_tcp_session.part.0 (fs/smb/client/connect.c:3160 fs/smb/client/connect.c:1798) + cifs_mount_get_session (fs/smb/client/trace.h:959 fs/smb/client/connect.c:3366) + dfs_mount_share (fs/smb/client/dfs.c:63 fs/smb/client/dfs.c:285) + cifs_mount (fs/smb/client/connect.c:3622) + cifs_smb3_do_mount (fs/smb/client/cifsfs.c:949) + smb3_get_tree (fs/smb/client/fs_context.c:784 fs/smb/client/fs_context.c:802 fs/smb/client/fs_context.c:794) + vfs_get_tree (fs/super.c:1800) + path_mount (fs/namespace.c:3508 fs/namespace.c:3834) + __x64_sys_mount (fs/namespace.c:3848 fs/namespace.c:4057 fs/namespace.c:4034 fs/namespace.c:4034) + do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) + entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) + +Fixes: 26abe14379f8 ("net: Modify sk_alloc to not reference count the netns of kernel sockets.") +Signed-off-by: Kuniyuki Iwashima +Acked-by: Tom Talpey +Signed-off-by: Steve French +[ cherry-pick from amazon-linux amazon-6.1.y/mainline ] +Link: https://github.com/amazonlinux/linux/commit/12bb8c57cead +Signed-off-by: Xiangyu Chen +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/connect.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -1062,6 +1062,7 @@ static void clean_demultiplex_info(struc + */ + } + ++ put_net(cifs_net_ns(server)); + #ifdef CONFIG_CIFS_DFS_UPCALL + kfree(server->origin_fullpath); + kfree(server->leaf_fullpath); +@@ -1656,8 +1657,6 @@ cifs_put_tcp_session(struct TCP_Server_I + /* srv_count can never go negative */ + WARN_ON(server->srv_count < 0); + +- put_net(cifs_net_ns(server)); +- + list_del_init(&server->tcp_ses_list); + spin_unlock(&cifs_tcp_ses_lock); + +@@ -3041,7 +3040,10 @@ generic_ip_connect(struct TCP_Server_Inf + } + + if (socket == NULL) { +- rc = __sock_create(cifs_net_ns(server), sfamily, SOCK_STREAM, ++ struct net *net = cifs_net_ns(server); ++ struct sock *sk; ++ ++ rc = __sock_create(net, sfamily, SOCK_STREAM, + IPPROTO_TCP, &socket, 1); + if (rc < 0) { + cifs_server_dbg(VFS, "Error %d creating socket\n", rc); +@@ -3049,6 +3051,11 @@ generic_ip_connect(struct TCP_Server_Inf + return rc; + } + ++ sk = socket->sk; ++ sk->sk_net_refcnt = 1; ++ get_net_track(net, &sk->ns_tracker, GFP_KERNEL); ++ sock_inuse_add(net, 1); ++ + /* BB other socket options to set KEEPALIVE, NODELAY? */ + cifs_dbg(FYI, "Socket created\n"); + server->ssocket = socket;