Commit 90490156 authored by Jeremy Laratro's avatar Jeremy Laratro Committed by Steve French
Browse files

ksmbd: fix null pointer dereference in proc_show_files() 



When a SMB2 client opens a file with a durable v2 handle and then issues
SMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the
reconnectable file pointer but leaves the fp registered in global_ft.idr
until the durable scavenger fires (up to fp->durable_timeout seconds
later).

During that window any read of /proc/fs/ksmbd/files (mode 0400) panics
the kernel because proc_show_files() walks global_ft.idr and
unconditionally dereferences fp->tcon->id with no NULL guard.

Reproducer requires only a successful SMB2 SESSION_SETUP and a share
configured with 'durable handles = yes'. KASAN report on mainline
70390501:

  general protection fault, probably for non-canonical address
  0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  RIP: 0010:proc_show_files+0x118/0x740
  Call Trace:
   proc_show_files+0x118/0x740
   seq_read_iter+0x4ef/0xe10
   proc_reg_read_iter+0x1b7/0x280
   ...

Guard the dereference. A durable-disconnected fp legitimately has no
tcon; report its tree id as 0 rather than oopsing.

Fixes: b38f99c1 ("ksmbd: add procfs interface for runtime monitoring and statistics")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJeremy Laratro <research@aradex.io>
Acked-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent af92ee99

fs/smb/server/vfs_cache.c

+1 −1
Original line number Diff line number Diff line
@@ -81,7 +81,7 @@ static int proc_show_files(struct seq_file *m, void *v) 
	read_lock(&global_ft.lock);

	idr_for_each_entry(global_ft.idr, fp, id) {

		seq_printf(m, "%#-10x %#-10llx %#-10llx %#-10x",

			   fp->tcon->id,

			   fp->tcon ? fp->tcon->id : 0,

			   fp->persistent_id,

			   fp->volatile_id,

			   atomic_read(&fp->refcount));