【OLK-6.6】CIFS: use-after-free in cifs_oplock_break

> _**请尽量提供详细的信息，如缺乏必要的定位信息，则缺陷不会被定位**_

## 环境信息

【OS版本】（如openEuler-22.03-LTS，参考命令"cat /etc/os-release"结果）

【内核版本】（如kernel-5.10.0-60.138.0.165，参考命令"uname -r"结果）

【硬件平台】（缺陷相关的硬件信息，如：处理器型号、内存、磁盘、网卡、BIOS 等信息）

【组网信息】（和网络、性能相关的问题，应该说明详细的组网和场景信息）

## 缺陷信息

【问题复现步骤】

~~~
POC:

```
#!/bin/bash
#
# This is a test library for shell.
#

[ -n "$TST_LIB_LOADED" ] && return 0

export TST_PASS=0
export TST_FAIL=0
export TST_BROK=0
export TST_WARN=0
export TST_CONF=0
export TST_COUNT=0
export TST_COLOR_ENABLED=1
export TST_LIB_LOADED=1

trap "tst_brk TBROK 'test interrupted'" INT

tst_flag2color()
{
	local ansi_color_blue='\033[1;34m'
	local ansi_color_green='\033[1;32m'
	local ansi_color_magenta='\033[1;35m'
	local ansi_color_red='\033[1;31m'
	local ansi_color_yellow='\033[1;33m'

case "$1" in
	TPASS) printf $ansi_color_green;;
	TFAIL) printf $ansi_color_red;;
	TBROK) printf $ansi_color_red;;
	TWARN) printf $ansi_color_magenta;;
	TINFO) printf $ansi_color_blue;;
	TCONF) printf $ansi_color_yellow;;
	esac
}

tst_color_enabled()
{
	[ $TST_COLOR_ENABLED -eq 1 ]  && return 1 || return 0
}

tst_print_colored()
{
	tst_color_enabled
	local color=$?

[ "$color" = "1" ] && tst_flag2color "$1"
	printf "$2"
	[ "$color" = "1" ] && printf '\033[0m'
}

tst_exit()
{
	local ret=0

if [ $TST_FAIL -gt 0 ]; then
        	ret=$((ret|1))
	fi                          
                            
	if [ $TST_BROK -gt 0 ]; then
        	ret=$((ret|2))      
	fi                          
                            
	if [ $TST_WARN -gt 0 ]; then
        	ret=$((ret|4))      
	fi                          
                            
	if [ $TST_CONF -gt 0 ]; then
        	ret=$((ret|32))     
	fi

cat >&2 << EOF

Summary:
passed   $TST_PASS
failed   $TST_FAIL
broken   $TST_BROK
skipped  $TST_CONF
warnings $TST_WARN
EOF
	
	exit $ret                       
}

_tst_inc_res()
{
	case "$1" in
	TPASS) TST_PASS=$((TST_PASS+1));;
	TFAIL) TST_FAIL=$((TST_FAIL+1));;
	TBROK) TST_BROK=$((TST_BROK+1));;
	TWARN) TST_WARN=$((TST_WARN+1));;
	TCONF) TST_CONF=$((TST_CONF+1));;
	TINFO) ;;
	*) tst_brk TBROK "Invalid res type '$1'";;
	esac
}

tst_res()
{
	local res=$1
        if type caller >/dev/null 2>&1;then
		caller_info=$(caller 2) ||
			caller_info=$(caller 1) ||
			caller_info=$(caller 0)

caller_info=$(echo "${caller_info}" | awk 'info=$NF":"$1 {print info}')
        fi

shift

tst_color_enabled
	local color=$?
	
	TST_COUNT=$(($TST_COUNT+1))

_tst_inc_res "$res"
	printf "$(date) $TST_ID $TST_COUNT ${caller_info} "
	tst_print_colored $res "$res: "
	echo -e "$@"
}

tst_brk()
{
	local res=$1
	shift

tst_res "$res" "$@"
	tst_exit
}

tst_begin_test()
{
	if [ -w /dev/kmsg ]; then
		export tst_date_time=`date +"%F %T%N"`
		echo "run test at $tst_date_time" > /dev/kmsg
	fi
}

_dmesg_since_test_start()
{
	if which tac > /dev/null 2>&1; then
		dmesg -T | tac | sed -ne "0,\#run test at $tst_date_time#p" | tac
	else
		dmesg -T >/dev/null 2>&1 && dmesg_cmd="dmesg -T" || dmesg_cmd="dmesg"
		tac_cmd="awk '{ lines[NR] = \$0 } END { for (i = NR; i > 0; i--) print lines[i] }'"
		eval "${dmesg_cmd} | ${tac_cmd} | sed -ne \"1,\#run test at ${tst_date_time}#p\" | ${tac_cmd}"
	fi
}

tst_check_dmesg_for()
{
	keywords=$@
	if [ -z "$keywords" ];then
		tst_res TWARN "tst_check_dmesg_for parameter is null"
	else
		_dmesg_since_test_start | grep -E -q "$keywords"
	fi
}

_tst_expect_pass()
{
	local fnc="$1"
	shift

eval $@
	if [ $? -eq 0 ]; then
		tst_res TPASS "$@ passed as expected"
		return 0
	else
		$fnc TFAIL "$@ failed unexpectedly"
		return 1
	fi
}

_tst_expect_fail()
{
    local fnc="$1"
    shift

eval $@
    if [ $? -ne 0 ]; then
        tst_res TPASS "$@ failed as expected"
        return 0
    else
        $fnc TFAIL "$@ pass unexpectedly"
        return 1
    fi
}

tst_expect_pass()
{
	_tst_expect_pass tst_res "$@"
}

tst_expect_fail()
{
    _tst_expect_fail tst_res "$@"
}

# check dmesg log for WARNING/Oops/etc.
tst_check_dmesg()
{
	ret=$(_dmesg_since_test_start | grep -E -q \
		-e "kernel BUG at" \
		-e "WARNING:" \
		-e "BUG:" \
		-e "WARNING:" \
		-e "Oops:" \
		-e "possible recursive locking detected" \
		-e "Internal error" \
		-e "suspicious RCU usage" \
		-e "possible circular locking dependency detected" \
		-e "general protection fault" \
		-e "BUG.*remaining" \
		-e "UBSAN" \
		-e "KASAN" \
		-e "unregister_netdevice: waiting for" \
		-e "Call trace")
	if [ $? -eq 0 ]; then
		tst_res TWARN "_check_dmesg: something found in dmesg\n$(_dmesg_since_test_start)"
	fi
}

# generate random number
#
# tst_rand          random between [0, 32767]
# tst_rand $1 $2    random between [$1, $2]  ($2-$1 should less than 32767)
tst_rand_int()
{
	if [ $# -eq 0 ]; then
		echo $RANDOM
	elif [ $# -eq 2 ]; then
		local min=$1
		local max=$2
		local offset=$(($max-$min+1))
		echo $(($RANDOM%$offset+$min))
	else
		tst_res TWARN "tst_rand only accepts 0 or 2 parameters"
	fi
}

if [ -z "$TST_ID" ]; then
	_tst_filename=$(basename $0) || \
		tst_brk TCONF "Failed to set TST_ID from \$0 ('$0')"
	TST_ID=${_tst_filename%%.*}
fi
export TST_ID="$TST_ID"

workdir=$(pwd)
tmp_dir="${workdir}/tmp"

kernel_version=$(uname -r)
smb_conf=${tmp_dir}/smb.conf
test_dir=${tmp_dir}/share
mount_dir=${tmp_dir}/mp
test_smb_conf=/etc/samba/smb.conf

smbd_status=false
KILL_PIDS=""

trap "do_post_2" exit

stop_smbd() {
    pidof smbd >/dev/null 2>&1 || return 0
    systemctl stop smb
}

start_smbd() {
    systemctl restart smb || return 1
    local i
    for i in {1..10}; do
        netstat -apn | grep smbd | grep -q 445 && return 0
        sleep 1
    done
    return 1
}

prepare_cifs() {
    local ret=0

if ! type smbd >/dev/null 2>&1; then
        echo "smbd is not found"
        return 1
    fi
    # Get the status of the original smbd 
    pidof smbd >/dev/null 2>&1 && smbd_status=true

mkdir -p "${test_dir}"
    cat >>"${smb_conf}" <<EOF
[global]
    workgroup = SAMBA
    security = user

map to guest = Bad User

[share]
    path = ${test_dir}
    browseable = yes
    read only = no
    guest ok = yes
    force user = root
    read only = no
EOF
    tst_expect_pass mount -o bind "${smb_conf}" "${test_smb_conf}"
    stop_smbd || return 1
}

do_pre() {
    tst_res TINFO "[start]do pre"
    tst_expect_pass prepare_cifs
    tst_res TINFO "[end]do_pre"
}

do_test() {
    tst_res TINFO "[start]do test"
    net_ns=cifs_ns
    test_veth=veth1
    local test_veth_peer=veth2
    local server_ip=192.168.11.2
    local client_ip=192.168.11.3
    local mask=24

mkdir -p "${mount_dir}"
    ip netns add ${net_ns}
    ip link add ${test_veth} type veth peer name ${test_veth_peer}
    ip link set ${test_veth} up
    ip addr add ${server_ip}/${mask} dev ${test_veth}
    ip link set ${test_veth_peer} netns ${net_ns}

sleep 1
    # After the server network is stable, start smbd. 
    tst_expect_pass start_smbd || return 1
    nsenter --net=/run/netns/${net_ns} bash -c "
    ip link set lo up
    ip link set ${test_veth_peer} up
    ip addr add ${client_ip}/${mask} dev ${test_veth_peer}

while true; do
			mount -t cifs //${server_ip}/share ${mount_dir} -o username=nobody,guest,echo_interval=1,cache=loose &&
				echo ${RANDOM} >> ${mount_dir}/testfile && cat ${mount_dir}/testfile >/dev/null
			grep "${mount_dir}" /proc/mounts | grep "rsize=0" && break

if grep -q "${mount_dir}" /proc/mounts; then
				dd if=${mount_dir}/testfile of=/dev/null iflag=direct > /dev/null 2>&1 &
				dd if=${mount_dir}/testfile of=/dev/null iflag=direct > /dev/null 2>&1 &
				dd if=${mount_dir}/testfile of=/dev/null iflag=direct > /dev/null 2>&1 &
				dd if=${mount_dir}/testfile of=/dev/null iflag=direct > /dev/null 2>&1 &

wait

umount "${mount_dir}"
			fi

mount -t cifs //${server_ip}/share ${mount_dir} -o username=nobody,guest,echo_interval=1,cache=none &&
				echo ${RANDOM} >> ${mount_dir}/testfile && cat ${mount_dir}/testfile >/dev/null
			grep "${mount_dir}" /proc/mounts | grep "rsize=0" && break

if grep -q "${mount_dir}" /proc/mounts; then
				dd if=${mount_dir}/testfile of=/dev/null iflag=direct > /dev/null 2>&1 &
				dd if=${mount_dir}/testfile of=/dev/null iflag=direct > /dev/null 2>&1 &
				dd if=${mount_dir}/testfile of=/dev/null iflag=direct > /dev/null 2>&1 &
				dd if=${mount_dir}/testfile of=/dev/null iflag=direct > /dev/null 2>&1 &

wait

umount "${mount_dir}"
			fi
		done
" &
    KILL_PIDS=$!
    # while true;do
    for i in $(seq 5); do
        echo inject $i
        iptables -A INPUT -d ${server_ip} -j DROP
        sleep 4
        iptables -D INPUT -d ${server_ip} -j DROP
        sleep 5
        df >/dev/null
    done

tst_res TINFO "[end]do_test"
}

do_post_1() {
    tst_res TINFO "[start]do post"
    [ -z "${KILL_PIDS}" ] || kill -9 "${KILL_PIDS}"
    wait
    killall -9 mount mount.cifs
    killall -9 umount

[ -f "/var/run/netns/${net_ns}" ] && tst_expect_pass "ip netns del ${net_ns}"

# Check that there are no veth leftovers 
    for i in {1..60}; do
        sleep 2
        if grep "${mount_dir}" /proc/mounts | grep "rsize=0"; then
            tst_res_fail "test fail"
        fi
        grep -q "${mount_dir}" /proc/mounts && umount "${mount_dir}"
        [ -d "/sys/class/net/${test_veth}/" ] || break
    done
    tst_expect_fail "test -d /sys/class/net/${test_veth}/" || ip a
    stop_smbd
    # Restore the state of smbd 
    mount | grep -q "${test_smb_conf}" && tst_expect_pass umount "${test_smb_conf}"
    ${smbd_status} && start_smbd
    [ -d "${tmp_dir}" ] && tst_expect_pass rm -rf "${tmp_dir}"
    iptables -D INPUT -d ${server_ip} -j DROP

tst_res TINFO "[end]do_post"
}

do_post_2() {
    do_post_1
    tst_check_dmesg
    tst_exit
}

run_testcase() {
    tst_begin_test
    do_pre
    [ "${TST_FAIL}" -ne 0 ] && exit 1
    do_test
}

run_testcase

```

~~~
while true; do bash cifs_uaf/runtest.sh; test $? -ne 0 && break; done

应用下面的补丁可以更快地复现问题。

```
diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c
index 0a5266ecfd15..a96810baa9ce 100644
--- a/fs/smb/client/cifsfs.c
+++ b/fs/smb/client/cifsfs.c
@@ -177,12 +177,15 @@ cifs_sb_active(struct super_block *sb)
 void
 cifs_sb_deactive(struct super_block *sb)
 {
 	struct cifs_sb_info *server = CIFS_SB(sb);
 
-	if (atomic_dec_and_test(&server->active))
+	if (atomic_dec_and_test(&server->active)) {
+		printk("delay for 10s\n");
+		mdelay(10 * 1000);
 		deactivate_super(sb);
+	}
 }
 
 static int
 cifs_read_super(struct super_block *sb)
 {
diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c
index e9212da32f01..16b5feab749e 100644
--- a/fs/smb/client/file.c
+++ b/fs/smb/client/file.c
@@ -3150,11 +3150,18 @@ void cifs_oplock_break(struct work_struct *work)
 	persistent_fid = cfile->fid.persistent_fid;
 	volatile_fid = cfile->fid.volatile_fid;
 	net_fid = cfile->fid.netfid;
 	oplock_break_cancelled = cfile->oplock_break_cancelled;
 
+	int flag = 0;
+	if (atomic_read(&cifs_sb->active) == 1)
+		flag = 1;
 	_cifsFileInfo_put(cfile, false /* do not wait for ourself */, false);
+	if (flag) {
+		printk("sleep 5s for UAF\n");
+		mdelay(5 * 1000);
+	}
 	/*
 	 * MS-SMB2 3.2.5.19.1 and 3.2.5.19.2 (and MS-CIFS 3.2.5.42) do not require
 	 * an acknowledgment to be sent when the file has already been closed.
 	 */
 	spin_lock(&cinode->open_file_lock);
```

【实际结果】请描述出问题的结果和影响

~~~
[  169.301544][  T452] ==================================================================
[  169.305220][  T452] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x6b/0xd0
[  169.308400][  T452] Write of size 4 at addr ffff888108beb510 by task kworker/2:3/452
[  169.311466][  T452] 
[  169.312379][  T452] CPU: 2 PID: 452 Comm: kworker/2:3 Tainted: G            E      6.6.0+ #49
[  169.315761][  T452] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
[  169.319084][  T452] Workqueue: cifsoplockd cifs_oplock_break [cifs]
[  169.321598][  T452] Call Trace:
[  169.322600][  T452]  <TASK>
[  169.323507][  T452]  dump_stack_lvl+0x32/0x50
[  169.324876][  T452]  print_address_description.constprop.0+0x6b/0x3d0
[  169.326507][  T452]  ? _raw_spin_lock+0x6b/0xd0
[  169.327593][  T452]  print_report+0xba/0x280
[  169.328516][  T452]  ? __virt_addr_valid+0xcc/0x160
[  169.329341][  T452]  ? kasan_addr_to_slab+0x9/0x90
[  169.330226][  T452]  ? _raw_spin_lock+0x6b/0xd0
[  169.331279][  T452]  kasan_report+0xa5/0xd0
[  169.332216][  T452]  ? _raw_spin_lock+0x6b/0xd0
[  169.333235][  T452]  kasan_check_range+0xfc/0x1b0
[  169.334307][  T452]  _raw_spin_lock+0x6b/0xd0
[  169.335292][  T452]  ? __pfx__raw_spin_lock+0x10/0x10
[  169.336433][  T452]  cifs_oplock_break+0x4cb/0x9f0 [cifs]
[  169.338061][  T452]  ? __pfx_cifs_oplock_break+0x10/0x10 [cifs]
[  169.339712][  T452]  ? __pfx___schedule+0x10/0x10
[  169.340556][  T452]  ? kick_pool+0x37/0x1b0
[  169.341317][  T452]  process_one_work+0x2f2/0x5d0
[  169.342191][  T452]  worker_thread+0x38d/0x4f0
[  169.342982][  T452]  ? __pfx_worker_thread+0x10/0x10
[  169.343870][  T452]  kthread+0x159/0x190
[  169.344575][  T452]  ? __pfx_kthread+0x10/0x10
[  169.345378][  T452]  ret_from_fork+0x30/0x50
[  169.346144][  T452]  ? __pfx_kthread+0x10/0x10
[  169.346951][  T452]  ret_from_fork_asm+0x1b/0x30
[  169.347784][  T452]  </TASK>
[  169.348319][  T452] 
[  169.348720][  T452] Allocated by task 610:
[  169.349456][  T452]  kasan_save_stack+0x1c/0x40
[  169.350259][  T452]  kasan_set_track+0x21/0x30
[  169.351062][  T452]  __kasan_slab_alloc+0x6a/0x70
[  169.351922][  T452]  kmem_cache_alloc_lru+0x16a/0x4b0
[  169.352831][  T452]  cifs_alloc_inode+0x1f/0x200 [cifs]
[  169.354108][  T452]  alloc_inode+0x32/0x110
[  169.354850][  T452]  iget5_locked+0x50/0xa0
[  169.355645][  T452]  cifs_iget+0xc3/0x1a0 [cifs]
[  169.356817][  T452]  update_inode_info+0x69/0xd0 [cifs]
[  169.358076][  T452]  cifs_get_inode_info+0x120/0x240 [cifs]
[  169.359400][  T452]  cifs_do_create.isra.0+0x5a7/0xb30 [cifs]
[  169.360716][  T452]  cifs_atomic_open+0x367/0x840 [cifs]
[  169.361867][  T452]  lookup_open.isra.0+0x71e/0x8c0
[  169.362730][  T452]  open_last_lookups+0x340/0x7f0
[  169.363582][  T452]  path_openat+0xf7/0x3b0
[  169.364334][  T452]  do_filp_open+0x14c/0x270
[  169.365102][  T452]  do_sys_openat2+0x2d0/0x340
[  169.365917][  T452]  __x64_sys_openat+0xe9/0x140
[  169.366748][  T452]  do_syscall_64+0x55/0x100
[  169.367527][  T452]  entry_SYSCALL_64_after_hwframe+0x78/0xe2
[  169.368563][  T452] 
[  169.368978][  T452] Freed by task 452:
[  169.369649][  T452]  kasan_save_stack+0x1c/0x40
[  169.370457][  T452]  kasan_set_track+0x21/0x30
[  169.371242][  T452]  kasan_save_free_info+0x27/0x40
[  169.372107][  T452]  __kasan_slab_free+0x106/0x180
[  169.372963][  T452]  kmem_cache_free+0xbd/0x4e0
[  169.373775][  T452]  rcu_do_batch+0x30a/0x7d0
[  169.374553][  T452]  rcu_core+0x1ae/0x3a0
[  169.375282][  T452]  handle_softirqs+0x10c/0x390
[  169.376104][  T452]  irq_exit_rcu+0xe4/0x110
[  169.376884][  T452]  sysvec_apic_timer_interrupt+0x6e/0x90
[  169.377871][  T452]  asm_sysvec_apic_timer_interrupt+0x16/0x20
[  169.378903][  T452] 
[  169.379311][  T452] Last potentially related work creation:
[  169.380290][  T452]  kasan_save_stack+0x1c/0x40
[  169.381090][  T452]  __kasan_record_aux_stack+0x94/0xa0
[  169.381795][  T452]  __call_rcu_common.constprop.0+0x9b/0x540
[  169.382572][  T452]  dispose_list+0x8e/0xc0
[  169.383139][  T452]  evict_inodes+0x247/0x2b0
[  169.383734][  T452]  generic_shutdown_super+0x6f/0x240
[  169.384440][  T452]  kill_anon_super+0x1e/0x50
[  169.385231][  T452]  cifs_kill_sb+0x94/0xa0 [cifs]
[  169.386428][  T452]  deactivate_locked_super+0x52/0xa0
[  169.387282][  T452]  cifsFileInfo_put_final+0x21d/0x250 [cifs]
[  169.388488][  T452]  _cifsFileInfo_put+0x5ca/0x7b0 [cifs]
[  169.389630][  T452]  cifs_oplock_break+0x4bb/0x9f0 [cifs]
[  169.390739][  T452]  process_one_work+0x2f2/0x5d0
[  169.391600][  T452]  worker_thread+0x38d/0x4f0
[  169.392391][  T452]  kthread+0x159/0x190
[  169.393094][  T452]  ret_from_fork+0x30/0x50
[  169.393888][  T452]  ret_from_fork_asm+0x1b/0x30
[  169.394687][  T452] 
[  169.395093][  T452] The buggy address belongs to the object at ffff888108beb1e0
[  169.395093][  T452]  which belongs to the cache cifs_inode_cache of size 936
[  169.397575][  T452] The buggy address is located 816 bytes inside of
[  169.397575][  T452]  freed 936-byte region [ffff888108beb1e0, ffff888108beb588)
[  169.399975][  T452] 
[  169.400394][  T452] The buggy address belongs to the physical page:
[  169.401511][  T452] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x108be8
[  169.403089][  T452] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  169.404410][  T452] flags: 0x5fffff00000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
[  169.405843][  T452] raw: 005fffff00000840 ffff888106501a40 dead000000000122 0000000000000000
[  169.407330][  T452] raw: 0000000000000000 00000000801e001e 00000001ffffffff 0000000000000000
[  169.408803][  T452] head: 005fffff00000840 ffff888106501a40 dead000000000122 0000000000000000
[  169.410307][  T452] head: 0000000000000000 00000000801e001e 00000001ffffffff 0000000000000000
[  169.411817][  T452] head: 005fffff00000003 ffffea000422fa01 dead000000000122 00000000ffffffff
[  169.413312][  T452] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
[  169.414809][  T452] page dumped because: kasan: bad access detected
[  169.415925][  T452] 
[  169.416334][  T452] Memory state around the buggy address:
[  169.417292][  T452]  ffff888108beb400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  169.418668][  T452]  ffff888108beb480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  169.420063][  T452] >ffff888108beb500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  169.421453][  T452]                          ^
[  169.422242][  T452]  ffff888108beb580: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  169.423618][  T452]  ffff888108beb600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  169.425013][  T452] ==================================================================
~~~

【期望结果】请描述出期望的结果和影响

【其他相关附件信息】比如 syslog、dmesg、panic、lockup、kdump 信息、图片等

```
# 这里可以附上相关文本信息
```

【已分析信息】如已经做过分析和定位，请尽量附上详细的分析结果

GVP openEuler/kernel
Closed

Content Risk Flag

Comments (3)

GVPopenEuler/kernelClosed

Content Risk Flag