• David Disseldorp's avatar
    cifs: fix use-after-free bug in find_writable_file · 57cf01ac
    David Disseldorp authored
    commit e1e9bda22d7ddf88515e8fe401887e313922823e upstream.
    
    Under intermittent network outages, find_writable_file() is susceptible
    to the following race condition, which results in a user-after-free in
    the cifs_writepages code-path:
    
    Thread 1                                        Thread 2
    ========                                        ========
    
    inv_file = NULL
    refind = 0
    spin_lock(&cifs_file_list_lock)
    
    // invalidHandle found on openFileList
    
    inv_file = open_file
    // inv_file->count currently 1
    
    cifsFileInfo_get(inv_file)
    // inv_file->count = 2
    
    spin_unlock(&cifs_file_list_lock);
    
    cifs_reopen_file()                            cifs_close()
    // fails (rc != 0)                            ->cifsFileInfo_put()
                                           spin_lock(&cifs_file_list_lock)
                                           // inv_file->count = 1
                                           spin_unlock(&cifs_file_list_lock)
    
    spin_lock(&cifs_file_list_lock);
    list_move_tail(&inv_file->flist,
          &cifs_inode->openFileList);
    spin_unlock(&cifs_file_list_lock);
    
    cifsFileInfo_put(inv_file);
    ->spin_lock(&cifs_file_list_lock)
    
      // inv_file->count = 0
      list_del(&cifs_file->flist);
      // cleanup!!
      kfree(cifs_file);
    
      spin_unlock(&cifs_file_list_lock);
    
    spin_lock(&cifs_file_list_lock);
    ++refind;
    // refind = 1
    goto refind_writable;
    
    At this point we loop back through with an invalid inv_file pointer
    and a refind value of 1. On second pass, inv_file is not overwritten on
    openFileList traversal, and is subsequently dereferenced.
    Signed-off-by: default avatarDavid Disseldorp <ddiss@suse.de>
    Reviewed-by: default avatarJeff Layton <jlayton@samba.org>
    Signed-off-by: default avatarSteve French <smfrench@gmail.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    57cf01ac
file.c 94.6 KB