lkml.org 
[lkml]   [2018]   [Apr]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 01/74] cifs: do not allow creating sockets except with SMB1 posix exensions
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Steve French <smfrench@gmail.com>

    commit 1d0cffa674cfa7d185a302c8c6850fc50b893bed upstream.

    RHBZ: 1453123

    Since at least the 3.10 kernel and likely a lot earlier we have
    not been able to create unix domain sockets in a cifs share
    when mounted using the SFU mount option (except when mounted
    with the cifs unix extensions to Samba e.g.)
    Trying to create a socket, for example using the af_unix command from
    xfstests will cause :
    BUG: unable to handle kernel NULL pointer dereference at 00000000
    00000040

    Since no one uses or depends on being able to create unix domains sockets
    on a cifs share the easiest fix to stop this vulnerability is to simply
    not allow creation of any other special files than char or block devices
    when sfu is used.

    Added update to Ronnie's patch to handle a tcon link leak, and
    to address a buf leak noticed by Gustavo and Colin.

    Acked-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
    CC: Colin Ian King <colin.king@canonical.com>
    Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
    Reported-by: Eryu Guan <eguan@redhat.com>
    Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
    Signed-off-by: Steve French <smfrench@gmail.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/cifs/dir.c | 9 +++++----
    1 file changed, 5 insertions(+), 4 deletions(-)

    --- a/fs/cifs/dir.c
    +++ b/fs/cifs/dir.c
    @@ -673,6 +673,9 @@ int cifs_mknod(struct inode *inode, stru
    goto mknod_out;
    }

    + if (!S_ISCHR(mode) && !S_ISBLK(mode))
    + goto mknod_out;
    +
    if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL))
    goto mknod_out;

    @@ -681,10 +684,8 @@ int cifs_mknod(struct inode *inode, stru

    buf = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
    if (buf == NULL) {
    - kfree(full_path);
    rc = -ENOMEM;
    - free_xid(xid);
    - return rc;
    + goto mknod_out;
    }

    if (backup_cred(cifs_sb))
    @@ -731,7 +732,7 @@ int cifs_mknod(struct inode *inode, stru
    pdev->minor = cpu_to_le64(MINOR(device_number));
    rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms,
    &bytes_written, iov, 1);
    - } /* else if (S_ISFIFO) */
    + }
    tcon->ses->server->ops->close(xid, tcon, &fid);
    d_drop(direntry);


    \
     
     \ /
      Last update: 2018-04-27 17:22    [W:3.097 / U:0.352 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site