Re: [PATCH net v5 07/10] afs: Create a server appdata key

[David Howells]

Simon Horman <horms@xxxxxxxxxx> wrote:

> [Severity: Critical]
> This is a pre-existing issue, but is it safe to cast and dereference peer_data
> here?
> 
> When a network CHALLENGE packet arrives and is processed in the OOB queue in
> afs_respond_to_challenge(), it reads peer_data and casts it to an afs_server
> pointer.
> 
> Since the code dereferences this pointer without holding rcu_read_lock() or
> taking a reference on the server object, what happens if the server is
> concurrently destroyed or updated?
> 
> If peer_data is set to 0, this causes a direct NULL dereference. If the
> server memory is freed, could this result in a use-after-free triggered by a
> remote attacker?

Note that the OOB code is removed by these patches.

The other two issues here need addressing, though for one of them, the fix
will need to go via the vfs tree.

David