Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d339adc1 authored by Aurelien Aptel's avatar Aurelien Aptel Committed by Steve French
Browse files

CIFS: fix use-after-free of the lease keys 



The request buffers are freed right before copying the pointers.
Use the func args instead which are identical and still valid.

Simple reproducer (requires KASAN enabled) on a cifs mount:

echo foo > foo ; tail -f foo & rm foo

Cc: <stable@vger.kernel.org> # 4.20
Fixes: 179e44d4 ("smb3: add tracepoint for sending lease break responses to server")
Signed-off-by: default avatarAurelien Aptel <aaptel@suse.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
Reviewed-by: default avatarPaulo Alcantara <palcantara@suse.de>
parent 082aaa87

fs/cifs/smb2pdu.c

+2 −2
Original line number Diff line number Diff line
@@ -4441,8 +4441,8 @@ SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon, 
	rc = cifs_send_recv(xid, ses, &rqst, &resp_buf_type, flags, &rsp_iov);

	cifs_small_buf_release(req);



	please_key_low = (__u64 *)req->LeaseKey;

	please_key_high = (__u64 *)(req->LeaseKey+8);

	please_key_low = (__u64 *)lease_key;

	please_key_high = (__u64 *)(lease_key+8);

	if (rc) {

		cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);

		trace_smb3_lease_err(le32_to_cpu(lease_state), tcon->tid,