[PATCH OLK-6.6 0/3] FIX CVE-2026-98453
FIX CVE-2026-98453 ChenXiaoSong (2): smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() smb/client: pass cifs_open_info_data to SMB2_open() Zihan Xi (1): smb: client: close handle after create-context parsing failure fs/smb/client/link.c | 15 +++------------ fs/smb/client/smb2file.c | 19 ++++++++----------- fs/smb/client/smb2pdu.c | 34 +++++++++++++++++++--------------- fs/smb/client/smb2proto.h | 2 +- 4 files changed, 31 insertions(+), 39 deletions(-) -- 2.52.0
From: ChenXiaoSong <chenxiaosong@kylinos.cn> stable inclusion from stable-v6.6.160 commit b63f09fdcb523b5f664c8b90d2892a4c89cf8f3c category: cleanup bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20388 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/... -------------------------------- [ Upstream commit fc8789bb57e625e5f32ac57ca2e7d3e7b7fda225 ] SMB2_open() only fills the fixed fields, so a stack-allocated smb2_file_all_info is sufficient here. Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn> Signed-off-by: Steve French <stfrench@microsoft.com> Stable-dep-of: 566820af017e ("smb: client: close handle after create-context parsing failure") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Zizhi Wo <wozizhi@huawei.com> --- fs/smb/client/link.c | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/fs/smb/client/link.c b/fs/smb/client/link.c index 007da0a699cb..e1b23e7bd1b6 100644 --- a/fs/smb/client/link.c +++ b/fs/smb/client/link.c @@ -341,11 +341,11 @@ smb3_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, struct cifs_open_parms oparms; struct cifs_io_parms io_parms = {0}; int buf_type = CIFS_NO_BUFFER; __le16 *utf16_path; __u8 oplock = SMB2_OPLOCK_LEVEL_NONE; - struct smb2_file_all_info *pfile_info = NULL; + struct smb2_file_all_info file_info = {}; oparms = (struct cifs_open_parms) { .tcon = tcon, .cifs_sb = cifs_sb, .path = path, @@ -357,24 +357,16 @@ smb3_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); if (utf16_path == NULL) return -ENOMEM; - pfile_info = kzalloc(sizeof(struct smb2_file_all_info) + PATH_MAX * 2, - GFP_KERNEL); - - if (pfile_info == NULL) { - kfree(utf16_path); - return -ENOMEM; - } - - rc = SMB2_open(xid, &oparms, utf16_path, &oplock, pfile_info, NULL, + rc = SMB2_open(xid, &oparms, utf16_path, &oplock, &file_info, NULL, NULL, NULL); if (rc) goto qmf_out_open_fail; - if (pfile_info->EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) { + if (file_info.EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) { /* it's not a symlink */ rc = -ENOENT; /* Is there a better rc to return? */ goto qmf_out; } @@ -388,11 +380,10 @@ smb3_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, rc = SMB2_read(xid, &io_parms, pbytes_read, &pbuf, &buf_type); qmf_out: SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid); qmf_out_open_fail: kfree(utf16_path); - kfree(pfile_info); return rc; } int smb3_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, -- 2.52.0
From: ChenXiaoSong <chenxiaosong@kylinos.cn> stable inclusion from stable-v6.6.160 commit 2f8118f4c4313597d59b68af250427cfe9347d64 category: cleanup bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20388 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/... -------------------------------- [ Upstream commit 1f551e407bb49dce0bbd34ed6a499dad69e18020 ] Let SMB2_open() fill the smb2_file_all_info embedded in cifs_open_info_data directly. This removes the temporary smb2_file_all_info copy in smb2_open_file(). Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn> Signed-off-by: Steve French <stfrench@microsoft.com> For the 6.6 backport, keep the existing retry delay initialization and header declaration style. Move the existing open-done trace after create context parsing, retaining the stable six-argument tracepoint signature. This supplies the context needed to apply the follow-up handle cleanup in 566820af017e ("smb: client: close handle after create-context parsing failure") without importing the newer tracepoint API. Stable-dep-of: 566820af017e ("smb: client: close handle after create-context parsing failure") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Zizhi Wo <wozizhi@huawei.com> --- fs/smb/client/link.c | 6 +++--- fs/smb/client/smb2file.c | 19 ++++++++----------- fs/smb/client/smb2pdu.c | 31 ++++++++++++++++--------------- fs/smb/client/smb2proto.h | 2 +- 4 files changed, 28 insertions(+), 30 deletions(-) diff --git a/fs/smb/client/link.c b/fs/smb/client/link.c index e1b23e7bd1b6..221585e846c1 100644 --- a/fs/smb/client/link.c +++ b/fs/smb/client/link.c @@ -341,11 +341,11 @@ smb3_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, struct cifs_open_parms oparms; struct cifs_io_parms io_parms = {0}; int buf_type = CIFS_NO_BUFFER; __le16 *utf16_path; __u8 oplock = SMB2_OPLOCK_LEVEL_NONE; - struct smb2_file_all_info file_info = {}; + struct cifs_open_info_data data = {}; oparms = (struct cifs_open_parms) { .tcon = tcon, .cifs_sb = cifs_sb, .path = path, @@ -357,16 +357,16 @@ smb3_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon, utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); if (utf16_path == NULL) return -ENOMEM; - rc = SMB2_open(xid, &oparms, utf16_path, &oplock, &file_info, NULL, + rc = SMB2_open(xid, &oparms, utf16_path, &oplock, &data, NULL, NULL, NULL); if (rc) goto qmf_out_open_fail; - if (file_info.EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) { + if (data.fi.EndOfFile != cpu_to_le64(CIFS_MF_SYMLINK_FILE_SIZE)) { /* it's not a symlink */ rc = -ENOENT; /* Is there a better rc to return? */ goto qmf_out; } diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c index 53f3d1510516..24daae4b2721 100644 --- a/fs/smb/client/smb2file.c +++ b/fs/smb/client/smb2file.c @@ -109,12 +109,10 @@ int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms, __u32 { int rc; __le16 *smb2_path; __u8 smb2_oplock; struct cifs_open_info_data *data = buf; - struct smb2_file_all_info file_info = {}; - struct smb2_file_all_info *smb2_data = data ? &file_info : NULL; struct kvec err_iov = {}; int err_buftype = CIFS_NO_BUFFER; struct cifs_fid *fid = oparms->fid; struct network_resiliency_req nr_ioctl_req; bool retry_without_read_attributes = false; @@ -127,18 +125,18 @@ int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms, __u32 oparms->desired_access |= FILE_READ_ATTRIBUTES; retry_without_read_attributes = true; } smb2_oplock = SMB2_OPLOCK_LEVEL_BATCH; - rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, smb2_data, NULL, &err_iov, + rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, data, NULL, &err_iov, &err_buftype); if (rc == -EACCES && retry_without_read_attributes) { free_rsp_buf(err_buftype, err_iov.iov_base); memset(&err_iov, 0, sizeof(err_iov)); err_buftype = CIFS_NO_BUFFER; oparms->desired_access &= ~FILE_READ_ATTRIBUTES; - rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, smb2_data, NULL, &err_iov, + rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, data, NULL, &err_iov, &err_buftype); } if (rc && data) { struct smb2_hdr *hdr = err_iov.iov_base; @@ -147,13 +145,13 @@ int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms, __u32 if (hdr->Status == STATUS_STOPPED_ON_SYMLINK) { rc = smb2_parse_symlink_response(oparms->cifs_sb, &err_iov, oparms->path, &data->symlink_target); if (!rc) { - memset(smb2_data, 0, sizeof(*smb2_data)); + memset(&data->fi, 0, sizeof(data->fi)); oparms->create_options |= OPEN_REPARSE_POINT; - rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, smb2_data, + rc = SMB2_open(xid, oparms, smb2_path, &smb2_oplock, data, NULL, NULL, NULL); oparms->create_options &= ~OPEN_REPARSE_POINT; } } } @@ -178,27 +176,26 @@ int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms, __u32 cifs_dbg(FYI, "error %d setting resiliency\n", rc); rc = 0; } - if (smb2_data) { + if (data) { /* if open response does not have IndexNumber field - get it */ - if (smb2_data->IndexNumber == 0) { + if (data->fi.IndexNumber == 0) { rc = SMB2_get_srv_num(xid, oparms->tcon, fid->persistent_fid, fid->volatile_fid, - &smb2_data->IndexNumber); + &data->fi.IndexNumber); if (rc) { /* * let get_inode_info disable server inode * numbers */ - smb2_data->IndexNumber = 0; + data->fi.IndexNumber = 0; rc = 0; } } - memcpy(&data->fi, smb2_data, sizeof(data->fi)); } *oplock = smb2_oplock; out: free_rsp_buf(err_buftype, err_iov.iov_base); diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index bf20a65baf30..3efadae4e1b5 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -3217,11 +3217,11 @@ SMB2_open_free(struct smb_rqst *rqst) } } int SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, - __u8 *oplock, struct smb2_file_all_info *buf, + __u8 *oplock, struct cifs_open_info_data *buf, struct create_posix_rsp *posix, struct kvec *err_iov, int *buftype) { struct smb_rqst rqst; struct smb2_create_rsp *rsp = NULL; @@ -3232,10 +3232,11 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, struct kvec rsp_iov = {NULL, 0}; int resp_buftype = CIFS_NO_BUFFER; int rc = 0; int flags = 0; int retries = 0, cur_sleep = 1; + struct smb2_file_all_info *file_info = buf ? &buf->fi : NULL; replay_again: /* reinitialize for possible replay */ resp_buftype = CIFS_NO_BUFFER; memset(&rsp_iov, 0, sizeof(rsp_iov)); @@ -3287,37 +3288,37 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, tcon->need_reconnect = true; } goto creat_exit; } else if (rsp == NULL) /* unlikely to happen, but safer to check */ goto creat_exit; - else - trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, - oparms->create_options, oparms->desired_access); atomic_inc(&tcon->num_remote_opens); oparms->fid->persistent_fid = rsp->PersistentFileId; oparms->fid->volatile_fid = rsp->VolatileFileId; oparms->fid->access = oparms->desired_access; #ifdef CONFIG_CIFS_DEBUG2 oparms->fid->mid = le64_to_cpu(rsp->hdr.MessageId); #endif /* CIFS_DEBUG2 */ - if (buf) { - buf->CreationTime = rsp->CreationTime; - buf->LastAccessTime = rsp->LastAccessTime; - buf->LastWriteTime = rsp->LastWriteTime; - buf->ChangeTime = rsp->ChangeTime; - buf->AllocationSize = rsp->AllocationSize; - buf->EndOfFile = rsp->EndofFile; - buf->Attributes = rsp->FileAttributes; - buf->NumberOfLinks = cpu_to_le32(1); - buf->DeletePending = 0; + if (file_info) { + file_info->CreationTime = rsp->CreationTime; + file_info->LastAccessTime = rsp->LastAccessTime; + file_info->LastWriteTime = rsp->LastWriteTime; + file_info->ChangeTime = rsp->ChangeTime; + file_info->AllocationSize = rsp->AllocationSize; + file_info->EndOfFile = rsp->EndofFile; + file_info->Attributes = rsp->FileAttributes; + file_info->NumberOfLinks = cpu_to_le32(1); + file_info->DeletePending = 0; } rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch, - oparms->fid->lease_key, oplock, buf, posix); + oparms->fid->lease_key, oplock, file_info, posix); + + trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, + oparms->create_options, oparms->desired_access); creat_exit: SMB2_open_free(&rqst); free_rsp_buf(resp_buftype, rsp); if (is_replayable_error(rc) && diff --git a/fs/smb/client/smb2proto.h b/fs/smb/client/smb2proto.h index f553e3edd54e..da0adcb6a06d 100644 --- a/fs/smb/client/smb2proto.h +++ b/fs/smb/client/smb2proto.h @@ -152,11 +152,11 @@ extern int SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, struct cifs_tcon *tcon, const struct nls_table *); extern int SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon); extern int SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, __u8 *oplock, - struct smb2_file_all_info *buf, + struct cifs_open_info_data *buf, struct create_posix_rsp *posix, struct kvec *err_iov, int *resp_buftype); extern int SMB2_open_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, struct smb_rqst *rqst, -- 2.52.0
From: Zihan Xi <zihanx@nebusec.ai> stable inclusion from stable-v6.6.160 commit eaa97a196a107d4ef8775df2248181624151812e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20388 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/... -------------------------------- [ Upstream commit 566820af017e81497fb5e9d3ad6e7ffe2828bc8b ] SMB2_open() accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2_parse_contexts() rejects malformed context data, SMB2_open() returns without closing the handle, leaving the server-side handle open and num_remote_opens elevated. Close the handle after a post-CREATE context parsing failure so the error path releases the remote resource and balances the open count. Fixes: af1689a9b770 ("smb: client: fix potential OOBs in smb2_parse_contexts()") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Assisted-by: LLM Co-developed-by: Luxing Yin <root@tr0jan.top> Signed-off-by: Luxing Yin <root@tr0jan.top> Signed-off-by: Zihan Xi <zihanx@nebusec.ai> Tested-by: Frank Sorenson <sorenson@redhat.com> Signed-off-by: Paulo Alcantara <pc@manguebit.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Zizhi Wo <wozizhi@huawei.com> --- fs/smb/client/smb2pdu.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 3efadae4e1b5..50ed526646db 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -3312,10 +3312,13 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, } rc = smb2_parse_contexts(server, &rsp_iov, &oparms->fid->epoch, oparms->fid->lease_key, oplock, file_info, posix); + if (rc) + SMB2_close(xid, tcon, oparms->fid->persistent_fid, + oparms->fid->volatile_fid); trace_smb3_open_done(xid, rsp->PersistentFileId, tcon->tid, ses->Suid, oparms->create_options, oparms->desired_access); creat_exit: SMB2_open_free(&rqst); -- 2.52.0
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://atomgit.com/openeuler/kernel/merge_requests/30147 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/V7H... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://atomgit.com/openeuler/kernel/merge_requests/30147 Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/V7H...
participants (2)
-
patchwork bot -
Zizhi Wo