CVE-2024-35870: smb: client: fix UAF in smb2_reconnect_server()

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix UAF in smb2reconnectserver()

The UAF bug is due to smb2reconnectserver() accessing a session that is already being teared down by another thread that is executing cifsputsmbses(). This can happen when (a) the client has connection to the server but no session or (b) another thread ends up setting @ses->sesstatus again to something different than SESEXITING.

To fix this, we need to make sure to unconditionally set @ses->sesstatus to SESEXITING and prevent any other threads from setting a new status while we're still tearing it down.

The following can be reproduced by adding some delay to right after the ipc is freed in cifsputsmbses() - which will give smb2reconnectserver() worker a chance to run and then accessing @ses->ipc:

kinit ... mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echointerval=10 [disconnect srv] ls /mnt/1 &>/dev/null sleep 30 kdestroy [reconnect srv] sleep 10 umount /mnt/1 ... CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Workqueue: cifsiod smb2reconnectserver [cifs] RIP: 0010:listdelentryvalidorreport+0x33/0xf0 Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75 7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8 RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83 RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800 RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000 R13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000 FS: 0000000000000000(0000) GS:ffff888157c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? dieaddr+0x36/0x90 ? excgeneralprotection+0x1c1/0x3f0 ? asmexcgeneralprotection+0x26/0x30 ? listdelentryvalidorreport+0x33/0xf0 cifsputsmbses+0x1ae/0x500 [cifs] smb2reconnectserver+0x4ed/0x710 [cifs] processonework+0x205/0x6b0 workerthread+0x191/0x360 ? pfxworkerthread+0x10/0x10 kthread+0xe2/0x110 ? pfxkthread+0x10/0x10 retfromfork+0x34/0x50 ? pfxkthread+0x10/0x10 retfromforkasm+0x1a/0x30 </TASK>

— NVD