Paulo Alcantara (SUSE) 68ddb49680 cifs: Fix slab-out-of-bounds when tracing SMB tcon ... This patch fixes the following KASAN report: [ 779.044746] BUG: KASAN: slab-out-of-bounds in string+0xab/0x180 [ 779.044750] Read of size 1 at addr ffff88814f327968 by task trace-cmd/2812 [ 779.044756] CPU: 1 PID: 2812 Comm: trace-cmd Not tainted 5.1.0-rc1+ #62 [ 779.044760] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-0-ga698c89-prebuilt.qemu.org 04/01/2014 [ 779.044761] Call Trace: [ 779.044769] dump_stack+0x5b/0x90 [ 779.044775] ? string+0xab/0x180 [ 779.044781] print_address_description+0x6c/0x23c [ 779.044787] ? string+0xab/0x180 [ 779.044792] ? string+0xab/0x180 [ 779.044797] kasan_report.cold.3+0x1a/0x32 [ 779.044803] ? string+0xab/0x180 [ 779.044809] string+0xab/0x180 [ 779.044816] ? widen_string+0x160/0x160 [ 779.044822] ? vsnprintf+0x5bf/0x7f0 [ 779.044829] vsnprintf+0x4e7/0x7f0 [ 779.044836] ? pointer+0x4a0/0x4a0 [ 779.044841] ? seq_buf_vprintf+0x79/0xc0 [ 779.044848] seq_buf_vprintf+0x62/0xc0 [ 779.044855] trace_seq_printf+0x113/0x210 [ 779.044861] ? trace_seq_puts+0x110/0x110 [ 779.044867] ? trace_raw_output_prep+0xd8/0x110 [ 779.044876] trace_raw_output_smb3_tcon_class+0x9f/0xc0 [ 779.044882] print_trace_line+0x377/0x890 [ 779.044888] ? tracing_buffers_read+0x300/0x300 [ 779.044893] ? ring_buffer_read+0x58/0x70 [ 779.044899] s_show+0x6e/0x140 [ 779.044906] seq_read+0x505/0x6a0 [ 779.044913] vfs_read+0xaf/0x1b0 [ 779.044919] ksys_read+0xa1/0x130 [ 779.044925] ? kernel_write+0xa0/0xa0 [ 779.044931] ? __do_page_fault+0x3d5/0x620 [ 779.044938] do_syscall_64+0x63/0x150 [ 779.044944] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 779.044949] RIP: 0033:0x7f62c2c2db31 [ 779.044955] Code: fe ff ff 48 8d 3d 17 9e 09 00 48 83 ec 08 e8 96 02 02 00 66 0f 1f 44 00 00 8b 05 fa fc 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89 [ 779.044958] RSP: 002b:00007ffd6e116678 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 779.044964] RAX: ffffffffffffffda RBX: 0000560a38be9260 RCX: 00007f62c2c2db31 [ 779.044966] RDX: 0000000000002000 RSI: 00007ffd6e116710 RDI: 0000000000000003 [ 779.044966] RDX: 0000000000002000 RSI: 00007ffd6e116710 RDI: 0000000000000003 [ 779.044969] RBP: 00007f62c2ef5420 R08: 0000000000000000 R09: 0000000000000003 [ 779.044972] R10: ffffffffffffffa8 R11: 0000000000000246 R12: 00007ffd6e116710 [ 779.044975] R13: 0000000000002000 R14: 0000000000000d68 R15: 0000000000002000 [ 779.044981] Allocated by task 1257: [ 779.044987] __kasan_kmalloc.constprop.5+0xc1/0xd0 [ 779.044992] kmem_cache_alloc+0xad/0x1a0 [ 779.044997] getname_flags+0x6c/0x2a0 [ 779.045003] user_path_at_empty+0x1d/0x40 [ 779.045008] do_faccessat+0x12a/0x330 [ 779.045012] do_syscall_64+0x63/0x150 [ 779.045017] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 779.045019] Freed by task 1257: [ 779.045023] __kasan_slab_free+0x12e/0x180 [ 779.045029] kmem_cache_free+0x85/0x1b0 [ 779.045034] filename_lookup.part.70+0x176/0x250 [ 779.045039] do_faccessat+0x12a/0x330 [ 779.045043] do_syscall_64+0x63/0x150 [ 779.045048] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 779.045052] The buggy address belongs to the object at ffff88814f326600 which belongs to the cache names_cache of size 4096 [ 779.045057] The buggy address is located 872 bytes to the right of 4096-byte region [ffff88814f326600, ffff88814f327600) [ 779.045058] The buggy address belongs to the page: [ 779.045062] page:ffffea00053cc800 count:1 mapcount:0 mapping:ffff88815b191b40 index:0x0 compound_mapcount: 0 [ 779.045067] flags: 0x200000000010200(slab|head) [ 779.045075] raw: 0200000000010200 dead000000000100 dead000000000200 ffff88815b191b40 [ 779.045081] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 [ 779.045083] page dumped because: kasan: bad access detected [ 779.045085] Memory state around the buggy address: [ 779.045089] ffff88814f327800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 779.045093] ffff88814f327880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 779.045097] >ffff88814f327900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 779.045099] ^ [ 779.045103] ffff88814f327980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 779.045107] ffff88814f327a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 779.045109] ================================================================== [ 779.045110] Disabling lock debugging due to kernel taint Correctly assign tree name str for smb3_tcon event. Signed-off-by: Paulo Alcantara (SUSE) <paulo@paulo.ac> Signed-off-by: Steve French <stfrench@microsoft.com>		2019-03-22 22:36:54 -05:00
..
asn1.c	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
cache.c	cifs: use 64-bit timestamps for fscache	2018-08-07 14:15:41 -05:00
cifs_debug.c	smb3: display volume serial number for shares in /proc/fs/cifs/DebugData	2019-03-14 19:32:35 -05:00
cifs_debug.h	cifs: minor clarification in comments	2018-10-23 21:16:05 -05:00
cifs_dfs_ref.c	cifs: use correct format characters	2019-03-05 18:10:28 -06:00
cifs_fs_sb.h	smb3: make default i/o size for smb3 mounts larger	2019-03-04 20:05:35 -06:00
cifs_ioctl.h	SMB3: passthru query info doesn't check for SMB3 FSCTL passthru	2019-03-14 19:32:36 -05:00
cifs_spnego.c	smb3: on kerberos mount if server doesn't specify auth type use krb5	2018-11-02 14:09:41 -05:00
cifs_spnego.h
cifs_unicode.c	fs/cifs: don't translate SFM_SLASH (U+F026) to backslash	2018-09-02 23:21:42 -05:00
cifs_unicode.h	[SMB3] Remove ifdef since SMB3 (and later) now STRONGLY preferred	2017-07-08 18:57:07 -05:00
cifs_uniupr.h
cifsacl.c	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
cifsacl.h	cifs: For SMB2 security informaion query, check for minimum sized security descriptor instead of sizeof FileAllInformation class	2018-06-04 19:19:24 -05:00
cifsencrypt.c	cifs: remove coverity warning in calc_lanman_hash	2018-12-23 22:41:26 -06:00
cifsfs.c	cifs: fix that return -EINVAL when do dedupe operation	2019-03-22 22:36:54 -05:00
cifsfs.h	cifs: update internal module version number	2019-03-05 18:10:04 -06:00
cifsglob.h	CIFS: make mknod() an smb_version_op	2019-03-14 19:32:36 -05:00
cifspdu.h	smb3: missing defines and structs for reparse point handling	2018-11-02 14:09:41 -05:00
cifsproto.h	CIFS: Return error code when getting file handle for writeback	2019-03-05 18:10:04 -06:00
cifssmb.c	CIFS: Return error code when getting file handle for writeback	2019-03-05 18:10:04 -06:00
connect.c	cifs: remove unused value pointed out by Coverity	2019-03-14 19:32:36 -05:00
dfs_cache.c	cifs: Fix a tiny potential memory leak	2019-01-10 14:32:30 -06:00
dfs_cache.h	cifs: Add DFS cache routines	2018-12-28 10:05:58 -06:00
dir.c	CIFS: make mknod() an smb_version_op	2019-03-14 19:32:36 -05:00
dns_resolve.c
dns_resolve.h
export.c
file.c	CIFS: Fix an issue with re-sending rdata when transport returning -EAGAIN	2019-03-22 22:36:54 -05:00
fscache.c	cifs: use 64-bit timestamps for fscache	2018-08-07 14:15:41 -05:00
fscache.h	cifs: use 64-bit timestamps for fscache	2018-08-07 14:15:41 -05:00
inode.c	smb3: make default i/o size for smb3 mounts larger	2019-03-04 20:05:35 -06:00
ioctl.c	cifs: add support for ioctl on directories	2018-10-23 21:16:05 -05:00
Kconfig	fs: cifs: Kconfig: pedantic formatting	2019-03-06 21:55:12 -06:00
link.c	cifs: replace snprintf with scnprintf	2019-03-04 20:05:34 -06:00
Makefile	cifs: Add DFS cache routines	2018-12-28 10:05:58 -06:00
misc.c	cifs: Add support for failover in smb2_reconnect()	2018-12-28 10:13:11 -06:00
netmisc.c	cifs: use timespec64 internally	2018-08-07 14:15:41 -05:00
nterr.c
nterr.h
ntlmssp.h
readdir.c	cifs: check ntwrk_buf_start for NULL before dereferencing it	2018-12-23 22:41:31 -06:00
rfc1002pdu.h
sess.c	cifs: remove set but not used variable 'smb_buf'	2018-12-23 22:41:20 -06:00
smb1ops.c	CIFS: make mknod() an smb_version_op	2019-03-14 19:32:36 -05:00
smb2file.c	cifs: Fix potential OOB access of lock element array	2019-01-11 07:14:40 -06:00
smb2glob.h	cifs: change SMB2_OP_RENAME and SMB2_OP_HARDLINK to use compounding	2018-10-23 21:16:04 -05:00
smb2inode.c	smb3: Add dynamic trace points for various compounded smb3 ops	2019-03-14 19:32:35 -05:00
smb2maperror.c	fix incorrect error code mapping for OBJECTID_NOT_FOUND	2019-03-22 22:36:54 -05:00
smb2misc.c	CIFS: Do not reset lease state to NONE on lease break	2019-03-04 20:05:35 -06:00
smb2ops.c	SMB3: Allow SMB3 FSCTL queries to be sent to server from tools	2019-03-14 19:32:36 -05:00
smb2pdu.c	cifs: allow guest mounts to work for smb3.11	2019-03-22 22:36:54 -05:00
smb2pdu.h	cifs: fix smb3_zero_range so it can expand the file-size when required	2019-03-14 19:32:35 -05:00
smb2proto.h	cifs: add SMB2_ioctl_init/free helpers to be used with compounding	2019-03-14 19:32:35 -05:00
smb2status.h	smb2: fix typo in definition of a few error flags	2019-03-14 19:32:36 -05:00
smb2transport.c	CIFS: Only send SMB2_NEGOTIATE command on new TCP connections	2019-03-05 18:14:27 -06:00
smbdirect.c	cifs: replace snprintf with scnprintf	2019-03-04 20:05:34 -06:00
smbdirect.h	cifs: fix SMB1 breakage	2018-07-05 13:48:24 -05:00
smbencrypt.c	CIFS: refactor crypto shash/sdesc allocation&free	2018-04-01 20:24:39 -05:00
smberr.h
smbfsctl.h
trace.c	smb3: Cleanup license mess	2019-01-24 09:37:33 -06:00
trace.h	cifs: Fix slab-out-of-bounds when tracing SMB tcon	2019-03-22 22:36:54 -05:00
transport.c	cifs: simplify how we handle credits in compound_send_recv()	2019-03-14 19:32:35 -05:00
winucase.c
xattr.c	smb3: create smb3 equivalent alias for cifs pseudo-xattrs	2018-08-10 18:46:58 -05:00