[PATCH] cifs: fix UAF read of server->hostname in cifs_get_spnego_key()

[Henry Martin]

cifs_get_spnego_key() reads server->hostname without holding
server->srv_lock (fs/smb/client/cifs_spnego.c):

    const char *hostname = server->hostname;
    ...
    desc_len = ... + strlen(hostname) + ...
    ...
    dp += sprintf(dp, "ver=0x%x;host=%s;", ..., hostname);

while the DFS failover path frees and replaces the hostname under
srv_lock (__reconnect_target_locked(), fs/smb/client/connect.c):

    spin_lock(&server->srv_lock);
    kfree(server->hostname);
    server->hostname = hostname;
    spin_unlock(&server->srv_lock);

The read side runs on the kerberos auth path without the lock, so the
strlen() and the sprintf() can race with the free.

Take a stable copy of the hostname under srv_lock at function entry,
before any use.

This issue was discovered by Tencent CodeBuddy Security.

Fixes: 93d5cb517db3 ("cifs: Add support for failover in cifs_reconnect()")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Henry Martin <bsdhenrymartin@xxxxxxxxx>
---
 fs/smb/client/cifs_spnego.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/smb/client/cifs_spnego.c b/fs/smb/client/cifs_spnego.c
index 44c4072756804..488ddf6df138d 100644
--- a/fs/smb/client/cifs_spnego.c
+++ b/fs/smb/client/cifs_spnego.c
@@ -105,7 +105,15 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo,
 	char *description, *dp;
 	size_t desc_len;
 	struct key *spnego_key;
-	const char *hostname = server->hostname;
+	char hostname[CIFS_NI_MAXHOST + 1];
+
+	/* hostname is replaced under srv_lock by the DFS failover path
+	 * (kfree + new assignment); take a stable copy while holding the
+	 * lock so strlen()/sprintf() below cannot race with the free.
+	 */
+	spin_lock(&server->srv_lock);
+	strscpy(hostname, server->hostname, sizeof(hostname));
+	spin_unlock(&server->srv_lock);
 
 	/* length of fields (with semicolons): ver=0xyz ip4=ipaddress
 	   host=hostname sec=mechanism uid=0xFF user=username */
-- 
2.43.7