ACK: [SRU][J][PATCH 0/1] cifs: NULL pointer dereference in refresh_cache_worker

[Emil Renner Berthing]

Looks good to me:

Acked-by: Emil Renner Berthing <emil.renner.berthing at canonical.com>

Chengen Du wrote:
> BugLink: https://bugs.launchpad.net/bugs/2112440
>
> SRU Justification:
>
> [Impact]
> When refresh_cache_worker attempts to refresh DFS referrals, it may access uninitialized data, leading to a general protection fault caused by a NULL pointer dereference.
>
> [Fix]
> There is an upstream commit that addresses this issue:
>
> From 41f10081a92a0ed280008218a8ec18ad8ba0fceb Mon Sep 17 00:00:00 2001
> From: Paulo Alcantara <pc at cjr.nz>
> Date: Wed, 20 Apr 2022 21:05:45 -0300
> Subject: [PATCH] cifs: fix NULL ptr dereference in refresh_mounts()
>
> Either mount(2) or automount might not have server->origin_fullpath
> set yet while refresh_cache_worker() is attempting to refresh DFS
> referrals. Add missing NULL check and locking around it.
>
> This fixes bellow crash:
>
> [ 1070.276835] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
> [ 1070.277676] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> [ 1070.278219] CPU: 1 PID: 8506 Comm: kworker/u8:1 Not tainted 5.18.0-rc3 #10
> [ 1070.278701] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014
> [ 1070.279495] Workqueue: cifs-dfscache refresh_cache_worker [cifs]
> [ 1070.280044] RIP: 0010:strcasecmp+0x34/0x150
> [ 1070.280359] Code: 00 00 00 fc ff df 41 54 55 48 89 fd 53 48 83 ec 10 eb 03 4c 89 fe 48 89 ef 48 83 c5 01 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 08 84 c0 0f 85 bc 00 00 00 0f b6 45 ff 44
> [ 1070.281729] RSP: 0018:ffffc90008367958 EFLAGS: 00010246
> [ 1070.282114] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000
> [ 1070.282691] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 1070.283273] RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff873eda27
> [ 1070.283857] R10: ffffc900083679a0 R11: 0000000000000001 R12: ffff88812624c000
> [ 1070.284436] R13: dffffc0000000000 R14: ffff88810e6e9a88 R15: ffff888119bb9000
> [ 1070.284990] FS: 0000000000000000(0000) GS:ffff888151200000(0000) knlGS:0000000000000000
> [ 1070.285625] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 1070.286100] CR2: 0000561a4d922418 CR3: 000000010aecc000 CR4: 0000000000350ee0
> [ 1070.286683] Call Trace:
> [ 1070.286890] <TASK>
> [ 1070.287070] refresh_cache_worker+0x895/0xd20 [cifs]
> [ 1070.287475] ? __refresh_tcon.isra.0+0xfb0/0xfb0 [cifs]
> [ 1070.287905] ? __lock_acquire+0xcd1/0x6960
> [ 1070.288247] ? is_dynamic_key+0x1a0/0x1a0
> [ 1070.288591] ? lockdep_hardirqs_on_prepare+0x410/0x410
> [ 1070.289012] ? lock_downgrade+0x6f0/0x6f0
> [ 1070.289318] process_one_work+0x7bd/0x12d0
> [ 1070.289637] ? worker_thread+0x160/0xec0
> [ 1070.289970] ? pwq_dec_nr_in_flight+0x230/0x230
> [ 1070.290318] ? _raw_spin_lock_irq+0x5e/0x90
> [ 1070.290619] worker_thread+0x5ac/0xec0
> [ 1070.290891] ? process_one_work+0x12d0/0x12d0
> [ 1070.291199] kthread+0x2a5/0x350
> [ 1070.291430] ? kthread_complete_and_exit+0x20/0x20
> [ 1070.291770] ret_from_fork+0x22/0x30
> [ 1070.292050] </TASK>
> [ 1070.292223] Modules linked in: bpfilter cifs cifs_arc4 cifs_md4
> [ 1070.292765] ---[ end trace 0000000000000000 ]---
> [ 1070.293108] RIP: 0010:strcasecmp+0x34/0x150
> [ 1070.293471] Code: 00 00 00 fc ff df 41 54 55 48 89 fd 53 48 83 ec 10 eb 03 4c 89 fe 48 89 ef 48 83 c5 01 48 89 f8 48 89 fa 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 08 84 c0 0f 85 bc 00 00 00 0f b6 45 ff 44
> [ 1070.297718] RSP: 0018:ffffc90008367958 EFLAGS: 00010246
> [ 1070.298622] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000
> [ 1070.299428] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> [ 1070.300296] RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff873eda27
> [ 1070.301204] R10: ffffc900083679a0 R11: 0000000000000001 R12: ffff88812624c000
> [ 1070.301932] R13: dffffc0000000000 R14: ffff88810e6e9a88 R15: ffff888119bb9000
> [ 1070.302645] FS: 0000000000000000(0000) GS:ffff888151200000(0000) knlGS:0000000000000000
> [ 1070.303462] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 1070.304131] CR2: 0000561a4d922418 CR3: 000000010aecc000 CR4: 0000000000350ee0
> [ 1070.305004] Kernel panic - not syncing: Fatal exception
> [ 1070.305711] Kernel Offset: disabled
> [ 1070.305971] ---[ end Kernel panic - not syncing: Fatal exception ]---
>
> [Test Plan]
> This is a timing issue that is difficult to reproduce reliably.
> The fix involves adding proper locking and NULL checks.
> Since reproducing the problem is challenging, we can instead focus on verifying that the normal behavior remains correct.
> 1. Prepare a Windows environment with DFS configured.
> 2. Mount the Windows DFS share using CIFS and confirm it is accessible.
> mount -t cifs -v //dfs-server/share /mnt/ -o username=XXX,vers=3.0
> 3. Remount the share and verify that it remains accessible.
> mount -t cifs -v //dfs-server/share /mnt/ -o remount,rw,username=XXX,vers=3.0
>
> [Where problems could occur]
> The fix introduces locking and NULL checks in the CIFS code.
> If any regressions occur, they could significantly impact CIFS functionality.
>
> Paulo Alcantara (1):
>   cifs: fix NULL ptr dereference in refresh_mounts()
>
>  fs/cifs/connect.c   |  2 ++
>  fs/cifs/dfs_cache.c | 19 ++++++++++++-------
>  2 files changed, 14 insertions(+), 7 deletions(-)
>
> --
> 2.43.0
>
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team