From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Shyam Prasad N <sprasad@microsoft.com>,
Ronnie Sahlberg <lsahlber@redhat.com>,
Steve French <stfrench@microsoft.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.9 05/32] cifs: fix double free race when mount fails in cifs_get_root()
Date: Mon, 7 Mar 2022 10:18:31 +0100 [thread overview]
Message-ID: <20220307091634.595125710@linuxfoundation.org> (raw)
In-Reply-To: <20220307091634.434478485@linuxfoundation.org>
From: Ronnie Sahlberg <lsahlber@redhat.com>
[ Upstream commit 3d6cc9898efdfb062efb74dc18cfc700e082f5d5 ]
When cifs_get_root() fails during cifs_smb3_do_mount() we call
deactivate_locked_super() which eventually will call delayed_free() which
will free the context.
In this situation we should not proceed to enter the out: section in
cifs_smb3_do_mount() and free the same resources a second time.
[Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x32/0x60
[Thu Feb 10 12:59:06 2022] Read of size 8 at addr ffff888364f4d110 by task swapper/1/0
[Thu Feb 10 12:59:06 2022] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G OE 5.17.0-rc3+ #4
[Thu Feb 10 12:59:06 2022] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019
[Thu Feb 10 12:59:06 2022] Call Trace:
[Thu Feb 10 12:59:06 2022] <IRQ>
[Thu Feb 10 12:59:06 2022] dump_stack_lvl+0x5d/0x78
[Thu Feb 10 12:59:06 2022] print_address_description.constprop.0+0x24/0x150
[Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60
[Thu Feb 10 12:59:06 2022] kasan_report.cold+0x7d/0x117
[Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60
[Thu Feb 10 12:59:06 2022] __asan_load8+0x86/0xa0
[Thu Feb 10 12:59:06 2022] rcu_cblist_dequeue+0x32/0x60
[Thu Feb 10 12:59:06 2022] rcu_core+0x547/0xca0
[Thu Feb 10 12:59:06 2022] ? call_rcu+0x3c0/0x3c0
[Thu Feb 10 12:59:06 2022] ? __this_cpu_preempt_check+0x13/0x20
[Thu Feb 10 12:59:06 2022] ? lock_is_held_type+0xea/0x140
[Thu Feb 10 12:59:06 2022] rcu_core_si+0xe/0x10
[Thu Feb 10 12:59:06 2022] __do_softirq+0x1d4/0x67b
[Thu Feb 10 12:59:06 2022] __irq_exit_rcu+0x100/0x150
[Thu Feb 10 12:59:06 2022] irq_exit_rcu+0xe/0x30
[Thu Feb 10 12:59:06 2022] sysvec_hyperv_stimer0+0x9d/0xc0
...
[Thu Feb 10 12:59:07 2022] Freed by task 58179:
[Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50
[Thu Feb 10 12:59:07 2022] kasan_set_track+0x25/0x30
[Thu Feb 10 12:59:07 2022] kasan_set_free_info+0x24/0x40
[Thu Feb 10 12:59:07 2022] ____kasan_slab_free+0x137/0x170
[Thu Feb 10 12:59:07 2022] __kasan_slab_free+0x12/0x20
[Thu Feb 10 12:59:07 2022] slab_free_freelist_hook+0xb3/0x1d0
[Thu Feb 10 12:59:07 2022] kfree+0xcd/0x520
[Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0x149/0xbe0 [cifs]
[Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs]
[Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140
[Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0
[Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210
[Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0
[Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae
[Thu Feb 10 12:59:07 2022] Last potentially related work creation:
[Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50
[Thu Feb 10 12:59:07 2022] __kasan_record_aux_stack+0xb6/0xc0
[Thu Feb 10 12:59:07 2022] kasan_record_aux_stack_noalloc+0xb/0x10
[Thu Feb 10 12:59:07 2022] call_rcu+0x76/0x3c0
[Thu Feb 10 12:59:07 2022] cifs_umount+0xce/0xe0 [cifs]
[Thu Feb 10 12:59:07 2022] cifs_kill_sb+0xc8/0xe0 [cifs]
[Thu Feb 10 12:59:07 2022] deactivate_locked_super+0x5d/0xd0
[Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0xab9/0xbe0 [cifs]
[Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs]
[Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140
[Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0
[Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210
[Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0
[Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae
Reported-by: Shyam Prasad N <sprasad@microsoft.com>
Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/cifsfs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 375ccd209206a..95e4f074b7665 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -746,6 +746,7 @@ cifs_do_mount(struct file_system_type *fs_type,
out_super:
deactivate_locked_super(sb);
+ return root;
out:
cifs_cleanup_volume_info(volume_info);
return root;
--
2.34.1
next prev parent reply other threads:[~2022-03-07 9:21 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-07 9:18 [PATCH 4.9 00/32] 4.9.305-rc1 review Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 01/32] mac80211_hwsim: report NOACK frames in tx_status Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 02/32] mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 03/32] i2c: bcm2835: Avoid clock stretching timeouts Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 04/32] Input: clear BTN_RIGHT/MIDDLE on buttonpads Greg Kroah-Hartman
2022-03-07 9:18 ` Greg Kroah-Hartman [this message]
2022-03-07 9:18 ` [PATCH 4.9 06/32] dmaengine: shdma: Fix runtime PM imbalance on error Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 07/32] i2c: qup: allow COMPILE_TEST Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 08/32] net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 09/32] usb: gadget: dont release an existing dev->buf Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 10/32] usb: gadget: clear related members when goto fail Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 11/32] ata: pata_hpt37x: fix PCI clock detection Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 12/32] ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 13/32] xfrm: fix MTU regression Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 14/32] netfilter: nf_queue: dont assume sk is full socket Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 15/32] netfilter: nf_queue: fix possible use-after-free Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 16/32] net: dcb: flush lingering app table entries for unregistered devices Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 17/32] firmware: Fix a reference count leak Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 18/32] firmware: qemu_fw_cfg: fix kobject leak in probe error path Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 19/32] mac80211: fix forwarded mesh frames AC & queue selection Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 20/32] net: stmmac: fix return value of __setup handler Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 21/32] net: sxgbe: " Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 22/32] net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 23/32] efivars: Respect "block" flag in efivar_entry_set_safe() Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 24/32] can: gs_usb: change active_channelss type from atomic_t to u8 Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 25/32] ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions Greg Kroah-Hartman
2022-03-07 9:18 ` Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 26/32] soc: fsl: qe: Check of ioremap return value Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 27/32] net: chelsio: cxgb3: check the return value of pci_find_capability() Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 28/32] Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 29/32] Input: elan_i2c - fix regulator enable count imbalance after suspend/resume Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 30/32] HID: add mapping for KEY_ALL_APPLICATIONS Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 31/32] memfd: fix F_SEAL_WRITE after shmem huge page allocated Greg Kroah-Hartman
2022-03-07 9:18 ` [PATCH 4.9 32/32] net: dcb: disable softirqs in dcbnl_flush_dev() Greg Kroah-Hartman
2022-03-07 18:19 ` [PATCH 4.9 00/32] 4.9.305-rc1 review Florian Fainelli
2022-03-07 23:46 ` Shuah Khan
2022-03-08 8:18 ` Jon Hunter
2022-03-08 15:57 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220307091634.595125710@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lsahlber@redhat.com \
--cc=sashal@kernel.org \
--cc=sprasad@microsoft.com \
--cc=stable@vger.kernel.org \
--cc=stfrench@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.