Commit d339adc1 authored by Aurelien Aptel's avatar Aurelien Aptel Committed by Steve French

CIFS: fix use-after-free of the lease keys

The request buffers are freed right before copying the pointers.
Use the func args instead which are identical and still valid.

Simple reproducer (requires KASAN enabled) on a cifs mount:

echo foo > foo ; tail -f foo & rm foo

Cc: <stable@vger.kernel.org> # 4.20
Fixes: 179e44d4 ("smb3: add tracepoint for sending lease break responses to server")
Signed-off-by: default avatarAurelien Aptel <aaptel@suse.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
Reviewed-by: default avatarPaulo Alcantara <palcantara@suse.de>
parent 082aaa87
...@@ -4441,8 +4441,8 @@ SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, ...@@ -4441,8 +4441,8 @@ SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov); rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);
cifs_small_buf_release(req); cifs_small_buf_release(req);
please_key_low = (__u64 *)req->LeaseKey; please_key_low = (__u64 *)lease_key;
please_key_high = (__u64 *)(req->LeaseKey+8); please_key_high = (__u64 *)(lease_key+8);
if (rc) { if (rc) {
cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE); cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid, trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment