Re: [PATCH] smb: client: stop processing a read response after a receive error

[Paulo Alcantara]

Weiming Shi <bestswngs@xxxxxxxxx> writes:

> cifs_read_iter_from_socket() may call cifs_reconnect() before returning an
> error.  The reconnect path aborts pending mids and invokes their callbacks.
> The callback can then release the cifs_io_subrequest containing rdata.
>
> cifs_readv_receive() nevertheless continues after a negative return and may
> dereference rdata in cifs_readv_discard().  KASAN reports the resulting
> UAF:
>
>   BUG: KASAN: slab-use-after-free in cifs_readv_receive
>   Read of size 4 by task cifsd
>   cifs_readv_receive (fs/smb/client/transport.c:1284)
>   cifs_demultiplex_thread (fs/smb/client/connect.c:1355)
>   kthread (kernel/kthread.c:436)
>   ret_from_fork (arch/x86/kernel/process.c:158)
>
>   Freed by task 148:
>   netfs_put_subrequest (fs/netfs/objects.c:267)
>   netfs_read_collection (fs/netfs/read_collect.c:460)
>   netfs_wait_for_in_progress (fs/netfs/misc.c:462)
>
> Return the socket error immediately, as this path did before the iterator
> conversion.  This also avoids adding a negative length to total_read.
> ...

Applied.