| Message ID | 20240402193404.236159-11-pc@manguebit.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [01/12] smb: client: fix potential UAF in cifs_debug_files_proc_show() | expand |
Isn't this needed to send the SMB3 Logoff request? On Tue, Apr 2, 2024 at 2:35 PM Paulo Alcantara <pc@manguebit.com> wrote: > > Skip sessions that are being teared down (status == SES_EXITING) to > avoid UAF. > > Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com> > --- > fs/smb/client/smb2ops.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c > index 1506a0eb10ba..4fd2ffa2ebba 100644 > --- a/fs/smb/client/smb2ops.c > +++ b/fs/smb/client/smb2ops.c > @@ -4188,8 +4188,8 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key) > > spin_lock(&cifs_tcp_ses_lock); > list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { > - if (ses->Suid == ses_id) { > - spin_lock(&ses->ses_lock); > + spin_lock(&ses->ses_lock); > + if (ses->ses_status != SES_EXITING && ses->Suid == ses_id) { > ses_enc_key = enc ? ses->smb3encryptionkey : > ses->smb3decryptionkey; > memcpy(key, ses_enc_key, SMB3_ENC_DEC_KEY_SIZE); > @@ -4197,6 +4197,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key) > spin_unlock(&cifs_tcp_ses_lock); > return 0; > } > + spin_unlock(&ses->ses_lock); > } > spin_unlock(&cifs_tcp_ses_lock); > > -- > 2.44.0 > >
Steve French <smfrench@gmail.com> writes:
> Isn't this needed to send the SMB3 Logoff request?
Yes, good catch! Please drop this one.
Paulo Alcantara <pc@manguebit.com> writes: > Skip sessions that are being teared down (status == SES_EXITING) to > avoid UAF. > > Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com> > --- > fs/smb/client/smb2ops.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) As we can send encrypted session logoff when SMB2_SESSION_FLAG_ENCRYPT_DATA is set, then please ignore this one and patch 05/12.
diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 1506a0eb10ba..4fd2ffa2ebba 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4188,8 +4188,8 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key) spin_lock(&cifs_tcp_ses_lock); list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { - if (ses->Suid == ses_id) { - spin_lock(&ses->ses_lock); + spin_lock(&ses->ses_lock); + if (ses->ses_status != SES_EXITING && ses->Suid == ses_id) { ses_enc_key = enc ? ses->smb3encryptionkey : ses->smb3decryptionkey; memcpy(key, ses_enc_key, SMB3_ENC_DEC_KEY_SIZE); @@ -4197,6 +4197,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key) spin_unlock(&cifs_tcp_ses_lock); return 0; } + spin_unlock(&ses->ses_lock); } spin_unlock(&cifs_tcp_ses_lock);
Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com> --- fs/smb/client/smb2ops.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)