Skip to content

Commit f7f291e

Browse files
Paulo AlcantaraSteve French
Paulo Alcantara
authored and
Steve French
committed
cifs: fix oops during encryption
When running xfstests against Azure the following oops occurred on an arm64 system Unable to handle kernel write to read-only memory at virtual address ffff0001221cf000 Mem abort info: ESR = 0x9600004f EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x0f: level 3 permission fault Data abort info: ISV = 0, ISS = 0x0000004f CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000 [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003, pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787 Internal error: Oops: 9600004f [#1] PREEMPT SMP ... pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : __memcpy+0x40/0x230 lr : scatterwalk_copychunks+0xe0/0x200 sp : ffff800014e92de0 x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008 x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008 x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000 x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014 x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058 x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590 x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580 x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005 x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001 x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000 Call trace: __memcpy+0x40/0x230 scatterwalk_map_and_copy+0x98/0x100 crypto_ccm_encrypt+0x150/0x180 crypto_aead_encrypt+0x2c/0x40 crypt_message+0x750/0x880 smb3_init_transform_rq+0x298/0x340 smb_send_rqst.part.11+0xd8/0x180 smb_send_rqst+0x3c/0x100 compound_send_recv+0x534/0xbc0 smb2_query_info_compound+0x32c/0x440 smb2_set_ea+0x438/0x4c0 cifs_xattr_set+0x5d4/0x7c0 This is because in scatterwalk_copychunks(), we attempted to write to a buffer (@sign) that was allocated in the stack (vmalloc area) by crypt_message() and thus accessing its remaining 8 (x2) bytes ended up crossing a page boundary. To simply fix it, we could just pass @sign kmalloc'd from crypt_message() and then we're done. Luckily, we don't seem to pass any other vmalloc'd buffers in smb_rqst::rq_iov... Instead, let's map the correct pages and offsets from vmalloc buffers as well in cifs_sg_set_buf() and then avoiding such oopses. Signed-off-by: Paulo Alcantara (SUSE) <[email protected]> Cc: [email protected] Signed-off-by: Steve French <[email protected]>
1 parent 9d91f81 commit f7f291e

File tree

4 files changed

+140
-79
lines changed

4 files changed

+140
-79
lines changed

‎fs/cifs/cifsglob.h

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
#include <linux/in6.h>
1414
#include <linux/inet.h>
1515
#include <linux/slab.h>
16+
#include <linux/scatterlist.h>
17+
#include <linux/mm.h>
1618
#include <linux/mempool.h>
1719
#include <linux/workqueue.h>
1820
#include <linux/utsname.h>
@@ -2140,4 +2142,70 @@ static inline void move_cifs_info_to_smb2(struct smb2_file_all_info *dst, const
21402142
dst->FileNameLength = src->FileNameLength;
21412143
}
21422144

2145+
static inline unsigned int cifs_get_num_sgs(const struct smb_rqst *rqst,
2146+
int num_rqst,
2147+
const u8 *sig)
2148+
{
2149+
unsigned int len, skip;
2150+
unsigned int nents = 0;
2151+
unsigned long addr;
2152+
int i, j;
2153+
2154+
/* Assumes the first rqst has a transform header as the first iov.
2155+
* I.e.
2156+
* rqst[0].rq_iov[0] is transform header
2157+
* rqst[0].rq_iov[1+] data to be encrypted/decrypted
2158+
* rqst[1+].rq_iov[0+] data to be encrypted/decrypted
2159+
*/
2160+
for (i = 0; i < num_rqst; i++) {
2161+
/*
2162+
* The first rqst has a transform header where the
2163+
* first 20 bytes are not part of the encrypted blob.
2164+
*/
2165+
for (j = 0; j < rqst[i].rq_nvec; j++) {
2166+
struct kvec *iov = &rqst[i].rq_iov[j];
2167+
2168+
skip = (i == 0) && (j == 0) ? 20 : 0;
2169+
addr = (unsigned long)iov->iov_base + skip;
2170+
if (unlikely(is_vmalloc_addr((void *)addr))) {
2171+
len = iov->iov_len - skip;
2172+
nents += DIV_ROUND_UP(offset_in_page(addr) + len,
2173+
PAGE_SIZE);
2174+
} else {
2175+
nents++;
2176+
}
2177+
}
2178+
nents += rqst[i].rq_npages;
2179+
}
2180+
nents += DIV_ROUND_UP(offset_in_page(sig) + SMB2_SIGNATURE_SIZE, PAGE_SIZE);
2181+
return nents;
2182+
}
2183+
2184+
/* We can not use the normal sg_set_buf() as we will sometimes pass a
2185+
* stack object as buf.
2186+
*/
2187+
static inline struct scatterlist *cifs_sg_set_buf(struct scatterlist *sg,
2188+
const void *buf,
2189+
unsigned int buflen)
2190+
{
2191+
unsigned long addr = (unsigned long)buf;
2192+
unsigned int off = offset_in_page(addr);
2193+
2194+
addr &= PAGE_MASK;
2195+
if (unlikely(is_vmalloc_addr((void *)addr))) {
2196+
do {
2197+
unsigned int len = min_t(unsigned int, buflen, PAGE_SIZE - off);
2198+
2199+
sg_set_page(sg++, vmalloc_to_page((void *)addr), len, off);
2200+
2201+
off = 0;
2202+
addr += PAGE_SIZE;
2203+
buflen -= len;
2204+
} while (buflen);
2205+
} else {
2206+
sg_set_page(sg++, virt_to_page(addr), buflen, off);
2207+
}
2208+
return sg;
2209+
}
2210+
21432211
#endif /* _CIFS_GLOB_H */

‎fs/cifs/cifsproto.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -600,8 +600,8 @@ int setup_aio_ctx_iter(struct cifs_aio_ctx *ctx, struct iov_iter *iter, int rw);
600600
int cifs_alloc_hash(const char *name, struct shash_desc **sdesc);
601601
void cifs_free_hash(struct shash_desc **sdesc);
602602

603-
extern void rqst_page_get_length(struct smb_rqst *rqst, unsigned int page,
604-
unsigned int *len, unsigned int *offset);
603+
void rqst_page_get_length(const struct smb_rqst *rqst, unsigned int page,
604+
unsigned int *len, unsigned int *offset);
605605
struct cifs_chan *
606606
cifs_ses_find_chan(struct cifs_ses *ses, struct TCP_Server_Info *server);
607607
int cifs_try_adding_channels(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses);

‎fs/cifs/misc.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1136,8 +1136,8 @@ cifs_free_hash(struct shash_desc **sdesc)
11361136
* @len: Where to store the length for this page:
11371137
* @offset: Where to store the offset for this page
11381138
*/
1139-
void rqst_page_get_length(struct smb_rqst *rqst, unsigned int page,
1140-
unsigned int *len, unsigned int *offset)
1139+
void rqst_page_get_length(const struct smb_rqst *rqst, unsigned int page,
1140+
unsigned int *len, unsigned int *offset)
11411141
{
11421142
*len = rqst->rq_pagesz;
11431143
*offset = (page == 0) ? rqst->rq_offset : 0;

‎fs/cifs/smb2ops.c

Lines changed: 68 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -4204,69 +4204,82 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
42044204
memcpy(&tr_hdr->SessionId, &shdr->SessionId, 8);
42054205
}
42064206

4207-
/* We can not use the normal sg_set_buf() as we will sometimes pass a
4208-
* stack object as buf.
4209-
*/
4210-
static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf,
4211-
unsigned int buflen)
4207+
static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst,
4208+
int num_rqst, const u8 *sig, u8 **iv,
4209+
struct aead_request **req, struct scatterlist **sgl,
4210+
unsigned int *num_sgs)
42124211
{
4213-
void *addr;
4214-
/*
4215-
* VMAP_STACK (at least) puts stack into the vmalloc address space
4216-
*/
4217-
if (is_vmalloc_addr(buf))
4218-
addr = vmalloc_to_page(buf);
4219-
else
4220-
addr = virt_to_page(buf);
4221-
sg_set_page(sg, addr, buflen, offset_in_page(buf));
4212+
unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm);
4213+
unsigned int iv_size = crypto_aead_ivsize(tfm);
4214+
unsigned int len;
4215+
u8 *p;
4216+
4217+
*num_sgs = cifs_get_num_sgs(rqst, num_rqst, sig);
4218+
4219+
len = iv_size;
4220+
len += crypto_aead_alignmask(tfm) & ~(crypto_tfm_ctx_alignment() - 1);
4221+
len = ALIGN(len, crypto_tfm_ctx_alignment());
4222+
len += req_size;
4223+
len = ALIGN(len, __alignof__(struct scatterlist));
4224+
len += *num_sgs * sizeof(**sgl);
4225+
4226+
p = kmalloc(len, GFP_ATOMIC);
4227+
if (!p)
4228+
return NULL;
4229+
4230+
*iv = (u8 *)PTR_ALIGN(p, crypto_aead_alignmask(tfm) + 1);
4231+
*req = (struct aead_request *)PTR_ALIGN(*iv + iv_size,
4232+
crypto_tfm_ctx_alignment());
4233+
*sgl = (struct scatterlist *)PTR_ALIGN((u8 *)*req + req_size,
4234+
__alignof__(struct scatterlist));
4235+
return p;
42224236
}
42234237

4224-
/* Assumes the first rqst has a transform header as the first iov.
4225-
* I.e.
4226-
* rqst[0].rq_iov[0] is transform header
4227-
* rqst[0].rq_iov[1+] data to be encrypted/decrypted
4228-
* rqst[1+].rq_iov[0+] data to be encrypted/decrypted
4229-
*/
4230-
static struct scatterlist *
4231-
init_sg(int num_rqst, struct smb_rqst *rqst, u8 *sign)
4238+
static void *smb2_get_aead_req(struct crypto_aead *tfm, const struct smb_rqst *rqst,
4239+
int num_rqst, const u8 *sig, u8 **iv,
4240+
struct aead_request **req, struct scatterlist **sgl)
42324241
{
4233-
unsigned int sg_len;
4242+
unsigned int off, len, skip;
42344243
struct scatterlist *sg;
4235-
unsigned int i;
4236-
unsigned int j;
4237-
unsigned int idx = 0;
4238-
int skip;
4239-
4240-
sg_len = 1;
4241-
for (i = 0; i < num_rqst; i++)
4242-
sg_len += rqst[i].rq_nvec + rqst[i].rq_npages;
4244+
unsigned int num_sgs;
4245+
unsigned long addr;
4246+
int i, j;
4247+
void *p;
42434248

4244-
sg = kmalloc_array(sg_len, sizeof(struct scatterlist), GFP_KERNEL);
4245-
if (!sg)
4249+
p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, sgl, &num_sgs);
4250+
if (!p)
42464251
return NULL;
42474252

4248-
sg_init_table(sg, sg_len);
4253+
sg_init_table(*sgl, num_sgs);
4254+
sg = *sgl;
4255+
4256+
/* Assumes the first rqst has a transform header as the first iov.
4257+
* I.e.
4258+
* rqst[0].rq_iov[0] is transform header
4259+
* rqst[0].rq_iov[1+] data to be encrypted/decrypted
4260+
* rqst[1+].rq_iov[0+] data to be encrypted/decrypted
4261+
*/
42494262
for (i = 0; i < num_rqst; i++) {
4263+
/*
4264+
* The first rqst has a transform header where the
4265+
* first 20 bytes are not part of the encrypted blob.
4266+
*/
42504267
for (j = 0; j < rqst[i].rq_nvec; j++) {
4251-
/*
4252-
* The first rqst has a transform header where the
4253-
* first 20 bytes are not part of the encrypted blob
4254-
*/
4255-
skip = (i == 0) && (j == 0) ? 20 : 0;
4256-
smb2_sg_set_buf(&sg[idx++],
4257-
rqst[i].rq_iov[j].iov_base + skip,
4258-
rqst[i].rq_iov[j].iov_len - skip);
4259-
}
4268+
struct kvec *iov = &rqst[i].rq_iov[j];
42604269

4270+
skip = (i == 0) && (j == 0) ? 20 : 0;
4271+
addr = (unsigned long)iov->iov_base + skip;
4272+
len = iov->iov_len - skip;
4273+
sg = cifs_sg_set_buf(sg, (void *)addr, len);
4274+
}
42614275
for (j = 0; j < rqst[i].rq_npages; j++) {
4262-
unsigned int len, offset;
4263-
4264-
rqst_page_get_length(&rqst[i], j, &len, &offset);
4265-
sg_set_page(&sg[idx++], rqst[i].rq_pages[j], len, offset);
4276+
rqst_page_get_length(&rqst[i], j, &len, &off);
4277+
sg_set_page(sg++, rqst[i].rq_pages[j], len, off);
42664278
}
42674279
}
4268-
smb2_sg_set_buf(&sg[idx], sign, SMB2_SIGNATURE_SIZE);
4269-
return sg;
4280+
cifs_sg_set_buf(sg, sig, SMB2_SIGNATURE_SIZE);
4281+
4282+
return p;
42704283
}
42714284

42724285
static int
@@ -4314,11 +4327,11 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
43144327
u8 sign[SMB2_SIGNATURE_SIZE] = {};
43154328
u8 key[SMB3_ENC_DEC_KEY_SIZE];
43164329
struct aead_request *req;
4317-
char *iv;
4318-
unsigned int iv_len;
4330+
u8 *iv;
43194331
DECLARE_CRYPTO_WAIT(wait);
43204332
struct crypto_aead *tfm;
43214333
unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
4334+
void *creq;
43224335

43234336
rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key);
43244337
if (rc) {
@@ -4352,32 +4365,15 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
43524365
return rc;
43534366
}
43544367

4355-
req = aead_request_alloc(tfm, GFP_KERNEL);
4356-
if (!req) {
4357-
cifs_server_dbg(VFS, "%s: Failed to alloc aead request\n", __func__);
4368+
creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg);
4369+
if (unlikely(!creq))
43584370
return -ENOMEM;
4359-
}
43604371

43614372
if (!enc) {
43624373
memcpy(sign, &tr_hdr->Signature, SMB2_SIGNATURE_SIZE);
43634374
crypt_len += SMB2_SIGNATURE_SIZE;
43644375
}
43654376

4366-
sg = init_sg(num_rqst, rqst, sign);
4367-
if (!sg) {
4368-
cifs_server_dbg(VFS, "%s: Failed to init sg\n", __func__);
4369-
rc = -ENOMEM;
4370-
goto free_req;
4371-
}
4372-
4373-
iv_len = crypto_aead_ivsize(tfm);
4374-
iv = kzalloc(iv_len, GFP_KERNEL);
4375-
if (!iv) {
4376-
cifs_server_dbg(VFS, "%s: Failed to alloc iv\n", __func__);
4377-
rc = -ENOMEM;
4378-
goto free_sg;
4379-
}
4380-
43814377
if ((server->cipher_type == SMB2_ENCRYPTION_AES128_GCM) ||
43824378
(server->cipher_type == SMB2_ENCRYPTION_AES256_GCM))
43834379
memcpy(iv, (char *)tr_hdr->Nonce, SMB3_AES_GCM_NONCE);
@@ -4386,6 +4382,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
43864382
memcpy(iv + 1, (char *)tr_hdr->Nonce, SMB3_AES_CCM_NONCE);
43874383
}
43884384

4385+
aead_request_set_tfm(req, tfm);
43894386
aead_request_set_crypt(req, sg, sg, crypt_len, iv);
43904387
aead_request_set_ad(req, assoc_data_len);
43914388

@@ -4398,11 +4395,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
43984395
if (!rc && enc)
43994396
memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
44004397

4401-
kfree_sensitive(iv);
4402-
free_sg:
4403-
kfree_sensitive(sg);
4404-
free_req:
4405-
kfree_sensitive(req);
4398+
kfree_sensitive(creq);
44064399
return rc;
44074400
}
44084401

0 commit comments

Comments
 (0)