In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: close durable scavenger races against m_fp_list lookups<\/p>\n
ksmbd_durable_scavenger() has two related races against any walker
\nthat iterates f_ci->m_fp_list, including ksmbd_lookup_fd_inode()
\n(used by ksmbd_vfs_rename) and the share-mode checks in
\nfs\/smb\/server\/smb_common.c.<\/p>\n
(1) fp->node list-head reuse. Durable-preserved handles can remain
\nlinked on f_ci->m_fp_list after session teardown so share-mode checks
\nstill see them while the handle is reconnectable. The scavenger
\ncollected expired handles by adding fp->node to a local
\nscavenger_list after removing them from the global durable idr.
\nBecause fp->node is the same list_head used by m_fp_list,
\nlist_add(&fp->node, &scavenger_list) overwrites the m_fp_list links
\nand corrupts both lists. CONFIG_DEBUG_LIST can report this on the
\nshare-mode walk path.<\/p>\n
(2) Refcount race against m_fp_list walkers. The scavenger qualifies
\nan expired durable handle with atomic_read(&fp->refcount) > 1 and
\nfp->conn under global_ft.lock, removes fp from global_ft, then drops
\nglobal_ft.lock before unlinking fp from m_fp_list and freeing it.
\nDuring that gap fp is still linked on m_fp_list with f_state ==
\nFP_INITED. ksmbd_lookup_fd_inode() under m_lock read calls
\nksmbd_fp_get() (atomic_inc_not_zero on refcount that is still 1) and
\ntakes a live reference; the scavenger then unlinks and frees fp
\nwhile the holder owns a reference, leading to UAF on the holder’s
\nsubsequent ksmbd_fd_put() and on any field reads performed by a
\nconcurrent share-mode walker that iterates m_fp_list without taking
\nksmbd_fp_get() (smb_check_perm_dleases-like paths).<\/p>\n
Fix both:<\/p>\n
* Stop reusing fp->node as a scavenger-private list node. Remove
\n one expired handle from global_ft under global_ft.lock, take an
\n explicit transient reference, drop the lock, unlink fp->node
\n from m_fp_list under f_ci->m_lock, then drop both the durable
\n lifetime and transient references with atomic_sub_and_test(2,
\n &fp->refcount). If the scavenger is the last putter the close
\n runs there; otherwise an in-flight holder that already raced
\n through the m_fp_list lookup owns the final close via its
\n ksmbd_fd_put() path. The one-at-a-time disposal can rescan the
\n durable idr when multiple handles expire in the same pass, but
\n durable scavenging is a background expiration path and the final
\n full scan recomputes min_timeout before the next wait.<\/p>\n
* Clear fp->persistent_id inside __ksmbd_remove_durable_fd() right
\n after idr_remove(), so a delayed final close from a holder that
\n snatched fp does not re-issue idr_remove() on a persistent id
\n that idr_alloc_cyclic() in ksmbd_open_durable_fd() may have
\n already handed out to a brand-new durable handle.<\/p>\n
* Bypass the per-conn open_files_count decrement in
\n __put_fd_final() when fp is detached from any session table
\n (fp->conn cleared by session_fd_check() at durable preserve —
\n paired with the volatile_id clear at unpublish, so checking
\n fp->conn alone is sufficient). The walker that owns the final
\n close runs from an unrelated work->conn whose
\n stats.open_files_count never tracked this durable fp; without
\n this guard the holder would underflow that unrelated counter.<\/p>\n
The two races are folded into one patch because patch (1) alone
\ncleans up the corrupted list but leaves a deterministic UAF window
\nfor m_fp_list walkers that the transient-reference and
\npersistent_id discipline in (2) close; bisecting onto an
\nintermediate state would land on a UAF that pre-patch chaos merely
\nmade less reproducible.<\/p>\n
Validation:
\n * CONFIG_DEBUG_LIST coverage for the list_head reuse path.
\n * KASAN-enabled direct SMB2 durable-handle coverage that exercised
\n ksmbd_durable_scavenger() and non-NULL ksmbd_lookup_fd_inode()
\n returns while durable handles expired under concurrent rename
\n lookups, with no KASAN, UAF, list-corruption, ODEBUG, or WARNING
\n reports.
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ksmbd: close durable scavenger races against m_fp_list lookups<\/p>\n
ksmbd_durable_scavenger() has two related races against any walker<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15102","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}