• Vincent Whitchurch's avatar
    cifs: Fix preauth hash corruption · 05946d4b
    Vincent Whitchurch authored
    smb311_update_preauth_hash() uses the shash in server->secmech without
    appropriate locking, and this can lead to sessions corrupting each
    other's preauth hashes.
    
    The following script can easily trigger the problem:
    
    	#!/bin/sh -e
    
    	NMOUNTS=10
    	for i in $(seq $NMOUNTS);
    		mkdir -p /tmp/mnt$i
    		umount /tmp/mnt$i 2>/dev/null || :
    	done
    	while :; do
    		for i in $(seq $NMOUNTS); do
    			mount -t cifs //192.168.0.1/test /tmp/mnt$i -o ... &
    		done
    		wait
    		for i in $(seq $NMOUNTS); do
    			umount /tmp/mnt$i
    		done
    	done
    
    Usually within seconds this leads to one or more of the mounts failing
    with the following errors, and a "Bad SMB2 signature for message" is
    seen in the server logs:
    
     CIFS: VFS: \\192.168.0.1 failed to connect to IPC (rc=-13)
     CIFS: VFS: cifs_mount failed w/return code = -13
    
    Fix it by holding the server mutex just like in the other places where
    the shashes are used.
    
    Fixes: 8bd68c6e ("CIFS: implement v3.11 preauth integrity")
    Signed-off-by: default avatarVincent Whitchurch <vincent.whitchurch@axis.com>
    CC: <stable@vger.kernel.org>
    Reviewed-by: default avatarAurelien Aptel <aaptel@suse.com>
    Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
    05946d4b
transport.c 42.9 KB