From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C6D631CD2F for ; Thu, 22 Aug 2024 03:32:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724297573; cv=none; b=J3aFvnXQuPLgyLUftF8EfOouYfpo6MT85PUJWGbJf0pbnV8CxMI4iqV3BkSZB76dQrpXWCc0CG980Sf5HGtWcl6ZCnalLrNcKt75GILf/7xphe3UmtvHu4CbzDCRUsReYuUIyw535UhNLXYTYbZN8KGJcK7Ybu+TNE3/Fjen9/U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724297573; c=relaxed/simple; bh=T8nPAEZdqvzQdh4uQP3e46/fPJDuheX5RysPyRPLNMA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=mvhyu7Ni+AdourtTIa249GfuVdNQIY/5iLjHVuc0LzJwFQKxeI986iz28ispyvkcs5TuyZ2LURp5pnac2XGO+K0LNiGQdJc712F1SsLFoVUqH5KhgZgaA9XsziSMclHpVzWm+AbXETa/u6moaiA2jenSxlvOZHMzzmhGjsN75IM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ULVCShfF; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ULVCShfF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E9C1C4AF0B; Thu, 22 Aug 2024 03:32:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1724297573; bh=T8nPAEZdqvzQdh4uQP3e46/fPJDuheX5RysPyRPLNMA=; h=From:To:Cc:Subject:Date:Reply-to:From; b=ULVCShfFnVsZyRIDtD5uCjUoQ7LGODDRmsEMeaRdT9/8ImGgR7qtRwfXxVtQZp+lO FmVppELdnGrbUXWX0s6rHeSrnARYMPiNuJm/Tf2zvqdwf+ziHyx5WJ1XXxoGmJ5KM0 Is/jSWJEMQgCLWcnnoCdVKXzfX+3sAa8ZPmD264U= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-48919: cifs: fix double free race when mount fails in cifs_get_root() Date: Thu, 22 Aug 2024 11:31:20 +0800 Message-ID: <2024082218-CVE-2022-48919-9bf1@gregkh> X-Mailer: git-send-email 2.46.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=5741; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=T8nPAEZdqvzQdh4uQP3e46/fPJDuheX5RysPyRPLNMA=; b=owGbwMvMwCRo6H6F97bub03G02pJDGnHNrL9sreZJb9r+pMZQrFXQvt3vdnOm1XxevHEFu5FS qs9HeKndMSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEEv8zLNi9QsF64of2DD0F 8Yuzzc7+y+Yt0GCYwyVraW/DYmcXsr/3n6FPe15yusEjAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: cifs: fix double free race when mount fails in cifs_get_root() When cifs_get_root() fails during cifs_smb3_do_mount() we call deactivate_locked_super() which eventually will call delayed_free() which will free the context. In this situation we should not proceed to enter the out: section in cifs_smb3_do_mount() and free the same resources a second time. [Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] Read of size 8 at addr ffff888364f4d110 by task swapper/1/0 [Thu Feb 10 12:59:06 2022] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G OE 5.17.0-rc3+ #4 [Thu Feb 10 12:59:06 2022] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019 [Thu Feb 10 12:59:06 2022] Call Trace: [Thu Feb 10 12:59:06 2022] [Thu Feb 10 12:59:06 2022] dump_stack_lvl+0x5d/0x78 [Thu Feb 10 12:59:06 2022] print_address_description.constprop.0+0x24/0x150 [Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] kasan_report.cold+0x7d/0x117 [Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] __asan_load8+0x86/0xa0 [Thu Feb 10 12:59:06 2022] rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] rcu_core+0x547/0xca0 [Thu Feb 10 12:59:06 2022] ? call_rcu+0x3c0/0x3c0 [Thu Feb 10 12:59:06 2022] ? __this_cpu_preempt_check+0x13/0x20 [Thu Feb 10 12:59:06 2022] ? lock_is_held_type+0xea/0x140 [Thu Feb 10 12:59:06 2022] rcu_core_si+0xe/0x10 [Thu Feb 10 12:59:06 2022] __do_softirq+0x1d4/0x67b [Thu Feb 10 12:59:06 2022] __irq_exit_rcu+0x100/0x150 [Thu Feb 10 12:59:06 2022] irq_exit_rcu+0xe/0x30 [Thu Feb 10 12:59:06 2022] sysvec_hyperv_stimer0+0x9d/0xc0 ... [Thu Feb 10 12:59:07 2022] Freed by task 58179: [Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50 [Thu Feb 10 12:59:07 2022] kasan_set_track+0x25/0x30 [Thu Feb 10 12:59:07 2022] kasan_set_free_info+0x24/0x40 [Thu Feb 10 12:59:07 2022] ____kasan_slab_free+0x137/0x170 [Thu Feb 10 12:59:07 2022] __kasan_slab_free+0x12/0x20 [Thu Feb 10 12:59:07 2022] slab_free_freelist_hook+0xb3/0x1d0 [Thu Feb 10 12:59:07 2022] kfree+0xcd/0x520 [Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0x149/0xbe0 [cifs] [Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs] [Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140 [Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0 [Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210 [Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0 [Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae [Thu Feb 10 12:59:07 2022] Last potentially related work creation: [Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50 [Thu Feb 10 12:59:07 2022] __kasan_record_aux_stack+0xb6/0xc0 [Thu Feb 10 12:59:07 2022] kasan_record_aux_stack_noalloc+0xb/0x10 [Thu Feb 10 12:59:07 2022] call_rcu+0x76/0x3c0 [Thu Feb 10 12:59:07 2022] cifs_umount+0xce/0xe0 [cifs] [Thu Feb 10 12:59:07 2022] cifs_kill_sb+0xc8/0xe0 [cifs] [Thu Feb 10 12:59:07 2022] deactivate_locked_super+0x5d/0xd0 [Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0xab9/0xbe0 [cifs] [Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs] [Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140 [Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0 [Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210 [Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0 [Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae The Linux kernel CVE team has assigned CVE-2022-48919 to this issue. Affected and fixed versions =========================== Fixed in 4.9.305 with commit da834d6c1147 Fixed in 4.14.270 with commit 147a0e71ccf9 Fixed in 4.19.233 with commit 2fe0e281f7ad Fixed in 5.4.183 with commit e208668ef7ba Fixed in 5.10.104 with commit df9db1a2af37 Fixed in 5.15.27 with commit 546d60859ecf Fixed in 5.16.13 with commit 563431c1f3c8 Fixed in 5.17 with commit 3d6cc9898efd Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-48919 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/cifs/cifsfs.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/da834d6c1147c7519a9e55b510a03b7055104749 https://git.kernel.org/stable/c/147a0e71ccf96df9fc8c2ac500829d8e423ef02c https://git.kernel.org/stable/c/2fe0e281f7ad0a62259649764228227dd6b2561d https://git.kernel.org/stable/c/e208668ef7ba23efcbf76a8200cab8deee501c4d https://git.kernel.org/stable/c/df9db1a2af37f39ad1653c7b9b0d275d72d0bc67 https://git.kernel.org/stable/c/546d60859ecf13380fcabcbeace53a5971493a2b https://git.kernel.org/stable/c/563431c1f3c8f2230e4a9c445fa23758742bc4f0 https://git.kernel.org/stable/c/3d6cc9898efdfb062efb74dc18cfc700e082f5d5