From 8e8d87b7d34f94d122bf44794bbca7faabd3687b Mon Sep 17 00:00:00 2001 From: Qi Zheng Date: Fri, 28 Jul 2023 09:25:38 +0900 Subject: [PATCH] ksmbd: fix potential UAF After calling opinfo_put(), the opinfo may be freed, then using this opinfo in the next traversal will cause UAF bug. To fix it, swap the call order of opinfo_put() and rcu_read_lock(), so that the opinfo_free_rcu() will not be called, and the opinfo will not be freed, then we can safely perform the next traversal. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Signed-off-by: Qi Zheng Signed-off-by: Namjae Jeon --- oplock.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/oplock.c b/oplock.c index 24c7d9a5..bc0dbfd0 100644 --- a/oplock.c +++ b/oplock.c @@ -1233,8 +1233,8 @@ int find_same_lease_key(struct ksmbd_session *sess, struct ksmbd_inode *ci, goto out; } op_next: - opinfo_put(opinfo); rcu_read_lock(); + opinfo_put(opinfo); } rcu_read_unlock(); @@ -1561,8 +1561,8 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, brk_op->open_trunc = is_trunc; oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE); next: - opinfo_conn_put(brk_op); rcu_read_lock(); + opinfo_conn_put(brk_op); } rcu_read_unlock(); @@ -1986,8 +1986,8 @@ struct oplock_info *lookup_lease_in_table(struct ksmbd_conn *conn, goto out; } op_next: - opinfo_put(opinfo); rcu_read_lock(); + opinfo_put(opinfo); } rcu_read_unlock();