linux-hardened/fs/cifs
Rabin Vincent bd975d1eea cifs: fix crash due to race in hmac(md5) handling
The secmech hmac(md5) structures are present in the TCP_Server_Info
struct and can be shared among multiple CIFS sessions.  However, the
server mutex is not currently held when these structures are allocated
and used, which can lead to a kernel crashes, as in the scenario below:

mount.cifs(8) #1				mount.cifs(8) #2

Is secmech.sdeschmaccmd5 allocated?
// false

						Is secmech.sdeschmaccmd5 allocated?
						// false

secmech.hmacmd = crypto_alloc_shash..
secmech.sdeschmaccmd5 = kzalloc..
sdeschmaccmd5->shash.tfm = &secmec.hmacmd;

						secmech.sdeschmaccmd5 = kzalloc
						// sdeschmaccmd5->shash.tfm
						// not yet assigned

crypto_shash_update()
 deref NULL sdeschmaccmd5->shash.tfm

 Unable to handle kernel paging request at virtual address 00000030
 epc   : 8027ba34 crypto_shash_update+0x38/0x158
 ra    : 8020f2e8 setup_ntlmv2_rsp+0x4bc/0xa84
 Call Trace:
  crypto_shash_update+0x38/0x158
  setup_ntlmv2_rsp+0x4bc/0xa84
  build_ntlmssp_auth_blob+0xbc/0x34c
  sess_auth_rawntlmssp_authenticate+0xac/0x248
  CIFS_SessSetup+0xf0/0x178
  cifs_setup_session+0x4c/0x84
  cifs_get_smb_ses+0x2c8/0x314
  cifs_mount+0x38c/0x76c
  cifs_do_mount+0x98/0x440
  mount_fs+0x20/0xc0
  vfs_kern_mount+0x58/0x138
  do_mount+0x1e8/0xccc
  SyS_mount+0x88/0xd4
  syscall_common+0x30/0x54

Fix this by locking the srv_mutex around the code which uses these
hmac(md5) structures.  All the other secmech algos already have similar
locking.

Fixes: 95dc8dd14e ("Limit allocation of crypto mechanisms to dialect which requires")
Signed-off-by: Rabin Vincent <rabinv@axis.com>
Acked-by: Sachin Prabhu <sprabhu@redhat.com>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: Steve French <smfrench@gmail.com>
2016-07-20 03:03:27 -05:00
..
asn1.c [CIFS] cifs: Rename cERROR and cFYI to cifs_dbg 2013-05-04 22:17:23 -05:00
cache.c [CIFS] cifs: Rename cERROR and cFYI to cifs_dbg 2013-05-04 22:17:23 -05:00
cifs_debug.c lib: update single-char callers of strtobool() 2016-03-17 15:09:34 -07:00
cifs_debug.h lib: update single-char callers of strtobool() 2016-03-17 15:09:34 -07:00
cifs_dfs_ref.c cifs: remove any preceding delimiter from prefix_path 2016-05-17 14:09:33 -05:00
cifs_fs_sb.h Allow conversion of characters in Mac remap range. Part 1 2014-10-16 15:20:20 -05:00
cifs_ioctl.h Add way to query server fs info for smb3 2015-08-20 10:19:25 -05:00
cifs_spnego.c cifs: Create dedicated keyring for spnego operations 2016-05-19 21:56:30 -05:00
cifs_spnego.h
cifs_unicode.c File names with trailing period or space need special case conversion 2016-06-24 12:05:52 -05:00
cifs_unicode.h File names with trailing period or space need special case conversion 2016-06-24 12:05:52 -05:00
cifs_uniupr.h
cifsacl.c KEYS: Add a facility to restrict new links into a keyring 2016-04-11 22:37:37 +01:00
cifsacl.h cifs: fix SID binary to string conversion 2012-12-11 11:48:49 -06:00
cifsencrypt.c cifs: fix crash due to race in hmac(md5) handling 2016-07-20 03:03:27 -05:00
cifsfs.c cifs: stuff the fl_owner into "pid" field in the lock request 2016-06-23 23:44:44 -05:00
cifsfs.h Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 2016-05-18 10:01:47 -07:00
cifsglob.h cifs: stuff the fl_owner into "pid" field in the lock request 2016-06-23 23:44:44 -05:00
cifspdu.h Add way to query server fs info for smb3 2015-08-20 10:19:25 -05:00
cifsproto.h cifs: Create dedicated keyring for spnego operations 2016-05-19 21:56:30 -05:00
cifssmb.c Merge branch 'sendmsg.cifs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-05-18 10:17:56 -07:00
connect.c cifs: unbreak TCP session reuse 2016-07-19 12:19:45 -05:00
dir.c cifs: Check for existing directory when opening file with O_CREAT 2016-07-12 16:09:38 -05:00
dns_resolve.c cifs: fix composing of mount options for DFS referrals 2013-05-24 13:08:31 -05:00
dns_resolve.h
export.c [CIFS] cifs: Rename cERROR and cFYI to cifs_dbg 2013-05-04 22:17:23 -05:00
file.c cifs: stuff the fl_owner into "pid" field in the lock request 2016-06-23 23:44:44 -05:00
fscache.c NFS client updates for Linux 3.13 2013-11-08 05:57:46 +09:00
fscache.h CIFS: FS-Cache: Uncache unread pages in cifs_readpages() before freeing them 2013-09-18 10:17:03 -05:00
inode.c Merge getxattr prototype change into work.lookups 2016-05-02 19:45:47 -04:00
ioctl.c vfs: pull btrfs clone API to vfs layer 2015-12-07 23:11:33 -05:00
Kconfig Allow parsing vers=3.11 on cifs mount 2015-06-27 20:23:32 -07:00
link.c switch ->get_link() to delayed_call, kill ->put_link() 2015-12-30 13:01:03 -05:00
Makefile cifs: Switch to generic xattr handlers 2016-04-23 15:33:03 -04:00
misc.c Prepare for encryption support (first part). Add decryption and encryption key generation. Thanks to Metze for helping with this. 2016-01-14 14:29:42 -06:00
netmisc.c Fix signed/unsigned pointer warning 2014-12-14 14:55:57 -06:00
nterr.c CIFS: Rename 7 error codes to NT_ style 2012-07-24 10:25:10 -05:00
nterr.h CIFS: Rename 7 error codes to NT_ style 2012-07-24 10:25:10 -05:00
ntlmssp.h cifs: dynamic allocation of ntlmssp blob 2016-06-23 23:45:07 -05:00
readdir.c cifs: Use file_dentry() 2016-05-17 14:09:33 -05:00
rfc1002pdu.h
sess.c cifs: check hash calculating succeeded 2016-06-23 23:45:17 -05:00
smb1ops.c Fix that several functions handle incorrect value of mapchars 2015-05-10 19:56:35 -05:00
smb2file.c Add resilienthandles mount parm 2015-11-03 10:10:36 -06:00
smb2glob.h remove directory incorrectly tries to set delete on close on non-empty directories 2016-05-17 14:09:44 -05:00
smb2inode.c remove directory incorrectly tries to set delete on close on non-empty directories 2016-05-17 14:09:44 -05:00
smb2maperror.c Fix problem recognizing symlinks 2014-10-02 14:10:04 -05:00
smb2misc.c Prepare for encryption support (first part). Add decryption and encryption key generation. Thanks to Metze for helping with this. 2016-01-14 14:29:42 -06:00
smb2ops.c Add MF-Symlinks support for SMB 2.0 2016-07-11 22:20:54 -05:00
smb2pdu.c Fix reconnect to not defer smb3 session reconnect long after socket reconnect 2016-06-24 12:04:50 -05:00
smb2pdu.h Prepare for encryption support (first part). Add decryption and encryption key generation. Thanks to Metze for helping with this. 2016-01-14 14:29:42 -06:00
smb2proto.h remove directory incorrectly tries to set delete on close on non-empty directories 2016-05-17 14:09:44 -05:00
smb2status.h CIFS: Add SMB2 status codes 2012-07-24 10:25:13 -05:00
smb2transport.c cifs: merge the hash calculation helpers 2016-03-28 14:05:27 -04:00
smbencrypt.c cifs: Use skcipher 2016-01-27 20:35:53 +08:00
smberr.h
smbfsctl.h [SMB3] Send durable handle v2 contexts when use of persistent handles required 2015-11-03 09:26:27 -06:00
transport.c cifs: quit playing games with draining iovecs 2016-03-28 14:05:32 -04:00
winucase.c [CIFS] quiet sparse compile warning 2013-09-08 14:54:24 -05:00
xattr.c switch xattr_handler->set() to passing dentry and inode separately 2016-05-27 15:39:43 -04:00