lkml.org 
[lkml]   [2019]   [Apr]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 29/96] cifs: Fix use-after-free in SMB2_write
    Date
    From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>

    commit 6a3eb3360667170988f8a6477f6686242061488a upstream.

    There is a KASAN use-after-free:
    BUG: KASAN: use-after-free in SMB2_write+0x1342/0x1580
    Read of size 8 at addr ffff8880b6a8e450 by task ln/4196

    Should not release the 'req' because it will use in the trace.

    Fixes: eccb4422cf97 ("smb3: Add ftrace tracepoints for improved SMB3 debugging")

    Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    CC: Stable <stable@vger.kernel.org> 4.18+
    Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/cifs/smb2pdu.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/fs/cifs/smb2pdu.c
    +++ b/fs/cifs/smb2pdu.c
    @@ -3591,7 +3591,6 @@ SMB2_write(const unsigned int xid, struc

    rc = cifs_send_recv(xid, io_parms->tcon->ses, &rqst,
    &resp_buftype, flags, &rsp_iov);
    - cifs_small_buf_release(req);
    rsp = (struct smb2_write_rsp *)rsp_iov.iov_base;

    if (rc) {
    @@ -3609,6 +3608,7 @@ SMB2_write(const unsigned int xid, struc
    io_parms->offset, *nbytes);
    }

    + cifs_small_buf_release(req);
    free_rsp_buf(resp_buftype, rsp);
    return rc;
    }

    \
     
     \ /
      Last update: 2019-04-24 19:31    [W:4.113 / U:0.124 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site