[PATCH] ksmbd: fix use-after-free of parent dentry in lease break notification

[PATCH] ksmbd: fix use-after-free of parent dentry in lease break notification

[Xingyuan Mo]

smb_send_parent_lease_break_noti() and smb_lazy_parent_lease_break_close()
pass the raw fp->filp->f_path.dentry->d_parent to
ksmbd_inode_lookup_lock() without holding a reference on the parent
dentry.  If the file is renamed out of its parent directory and the now
empty directory is removed concurrently, the parent dentry can be freed
before __ksmbd_inode_lookup() dereferences it, leading to a
use-after-free read of its d_inode field:

  BUG: KASAN: slab-use-after-free in __ksmbd_inode_lookup+0x21/0x100
  Read of size 8 at addr ffff88801aea06e8 by task kworker/0:7/332
  Workqueue: ksmbd-io handle_ksmbd_work
  Call Trace:
   __asan_load8+0x82/0xb0
   __ksmbd_inode_lookup+0x21/0x100
   ksmbd_inode_lookup_lock+0x25/0x50
   smb_send_parent_lease_break_noti+0x119/0x3a0
   smb2_open+0x5298/0x5df0
   handle_ksmbd_work+0x4f3/0xd30
  Allocated by task 11:
   __d_alloc+0x3a/0x410
   __d_alloc_parallel+0xd9/0xc00
   lookup_slow+0x49/0x70
  Freed by task 66:
   kmem_cache_free+0x22d/0x530
   __d_free+0x26/0x30
   dentry_free+0x8d/0x130
   dentry_kill+0x2e8/0x5a0
   dput+0x17/0x30
  The buggy address belongs to the object at ffff88801aea0680
  The buggy address is located 104 bytes inside of freed 352-byte region

The read at +104 is exactly the d_inode member of the parent dentry,
which was freed through dput() -> dentry_kill() -> dentry_free() after
the file had been renamed out of the directory and the directory was
removed.

Pin the parent with dget_parent() around the lookup in both functions so
that it stays alive until the lookup completes.

Fixes: d47d9886aeef7 ("ksmbd: send v2 lease break notification for directory")
Fixes: c2a721eead712 ("ksmbd: lazy v2 lease break on smb2_write()")
Signed-off-by: Xingyuan Mo <hdthky0@gmail.com>
---
 fs/smb/server/oplock.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c
index d479508c06c5f..c933d1e5f5458 100644
--- a/fs/smb/server/oplock.c
+++ b/fs/smb/server/oplock.c
@@ -1760,13 +1760,16 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp,
 				      struct lease_ctx_info *lctx)
 {
 	struct oplock_info *opinfo;
+	struct dentry *parent;
 	struct ksmbd_inode *p_ci = NULL;
 	LIST_HEAD(brk_list);
 
 	if (lctx && lctx->version != 2)
 		return;
 
-	p_ci = ksmbd_inode_lookup_lock(fp->filp->f_path.dentry->d_parent);
+	parent = dget_parent(fp->filp->f_path.dentry);
+	p_ci = ksmbd_inode_lookup_lock(parent);
+	dput(parent);
 	if (!p_ci)
 		return;
 
@@ -1797,6 +1800,7 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp,
 void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp)
 {
 	struct oplock_info *opinfo;
+	struct dentry *parent;
 	struct ksmbd_inode *p_ci = NULL;
 	LIST_HEAD(brk_list);
 
@@ -1809,7 +1813,9 @@ void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp)
 	}
 	rcu_read_unlock();
 
-	p_ci = ksmbd_inode_lookup_lock(fp->filp->f_path.dentry->d_parent);
+	parent = dget_parent(fp->filp->f_path.dentry);
+	p_ci = ksmbd_inode_lookup_lock(parent);
+	dput(parent);
 	if (!p_ci)
 		return;
 
-- 
2.43.0