[PATCH] cifs: fix UAF read of server->hostname in cifs_get_spnego_key()

[PATCH] cifs: fix UAF read of server->hostname in cifs_get_spnego_key()

[Henry Martin]

cifs_get_spnego_key() reads server->hostname without holding
server->srv_lock (fs/smb/client/cifs_spnego.c):

    const char *hostname = server->hostname;
    ...
    desc_len = ... + strlen(hostname) + ...
    ...
    dp += sprintf(dp, "ver=0x%x;host=%s;", ..., hostname);

while the DFS failover path frees and replaces the hostname under
srv_lock (__reconnect_target_locked(), fs/smb/client/connect.c):

    spin_lock(&server->srv_lock);
    kfree(server->hostname);
    server->hostname = hostname;
    spin_unlock(&server->srv_lock);

The read side runs on the kerberos auth path without the lock, so the
strlen() and the sprintf() can race with the free.

Take a stable copy of the hostname under srv_lock at function entry,
before any use.

This issue was discovered by Tencent CodeBuddy Security.

Fixes: 93d5cb517db3 ("cifs: Add support for failover in cifs_reconnect()")
Cc: stable@vger.kernel.org
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
 fs/smb/client/cifs_spnego.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/smb/client/cifs_spnego.c b/fs/smb/client/cifs_spnego.c
index 44c4072756804..488ddf6df138d 100644
--- a/fs/smb/client/cifs_spnego.c
+++ b/fs/smb/client/cifs_spnego.c
@@ -105,7 +105,15 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo,
 	char *description, *dp;
 	size_t desc_len;
 	struct key *spnego_key;
-	const char *hostname = server->hostname;
+	char hostname[CIFS_NI_MAXHOST + 1];
+
+	/* hostname is replaced under srv_lock by the DFS failover path
+	 * (kfree + new assignment); take a stable copy while holding the
+	 * lock so strlen()/sprintf() below cannot race with the free.
+	 */
+	spin_lock(&server->srv_lock);
+	strscpy(hostname, server->hostname, sizeof(hostname));
+	spin_unlock(&server->srv_lock);
 
 	/* length of fields (with semicolons): ver=0xyz ip4=ipaddress
 	   host=hostname sec=mechanism uid=0xFF user=username */
-- 
2.43.7

Re: [PATCH] cifs: fix UAF read of server->hostname in cifs_get_spnego_key()

[kernel test robot]

Hi Henry,

kernel test robot noticed the following build warnings:

[auto build test WARNING on manguebit/cifs-next]
[also build test WARNING on manguebit/cifs-fixes linus/master v7.3 next-20261027]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Henry-Martin/cifs-fix-UAF-read-of-server-hostname-in-cifs_get_spnego_key/20261027-230438
base:   https://git.manguebit.org/linux.git cifs-next
patch link:    https://lore.kernel.org/r/20261027150438.943354-1-bsdhenrymartin%40gmail.com
patch subject: [PATCH] cifs: fix UAF read of server->hostname in cifs_get_spnego_key()
config: arm-allyesconfig (https://download.01.org/0day-ci/archive/20261029/202610290208.vMXHYOZa-lkp@intel.com/config)
compiler: arm-linux-gnueabi-gcc (GCC) 16.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261029/202610290208.vMXHYOZa-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202610290208.vMXHYOZa-lkp@intel.com/

All warnings (new ones prefixed by >>):

   fs/smb/client/cifs_spnego.c: In function 'cifs_get_spnego_key':
>> fs/smb/client/cifs_spnego.c:199:1: warning: the frame size of 1304 bytes is larger than 1280 bytes [-Wframe-larger-than=]
     199 | }
         | ^


vim +199 fs/smb/client/cifs_spnego.c

f1d662a7d5e532 fs/cifs/cifs_spnego.c Steve French  2007-11-05  195  
f1d662a7d5e532 fs/cifs/cifs_spnego.c Steve French  2007-11-05  196  out:
f1d662a7d5e532 fs/cifs/cifs_spnego.c Steve French  2007-11-05  197  	kfree(description);
f1d662a7d5e532 fs/cifs/cifs_spnego.c Steve French  2007-11-05  198  	return spnego_key;
f1d662a7d5e532 fs/cifs/cifs_spnego.c Steve French  2007-11-05 @199  }
b74cb9a80268be fs/cifs/cifs_spnego.c Sachin Prabhu 2016-05-17  200  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki