CVE-2023-52741

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix use-after-free in rdata->read_into_pages()

When the network status is unstable, use-after-free may occur when

read data from the server.

BUG: KASAN: use-after-free in readpages_fill_pages+0x14c/0x7e0

Call Trace:

<TASK>

dump_stack_lvl+0x38/0x4c

print_report+0x16f/0x4a6

kasan_report+0xb7/0x130

readpages_fill_pages+0x14c/0x7e0

cifs_readv_receive+0x46d/0xa40

cifs_demultiplex_thread+0x121c/0x1490

kthread+0x16b/0x1a0

ret_from_fork+0x2c/0x50

</TASK>

Allocated by task 2535:

kasan_save_stack+0x22/0x50

kasan_set_track+0x25/0x30

__kasan_kmalloc+0x82/0x90

cifs_readdata_direct_alloc+0x2c/0x110

cifs_readdata_alloc+0x2d/0x60

cifs_readahead+0x393/0xfe0

read_pages+0x12f/0x470

page_cache_ra_unbounded+0x1b1/0x240

filemap_get_pages+0x1c8/0x9a0

filemap_read+0x1c0/0x540

cifs_strict_readv+0x21b/0x240

vfs_read+0x395/0x4b0

ksys_read+0xb8/0x150

do_syscall_64+0x3f/0x90

entry_SYSCALL_64_after_hwframe+0x72/0xdc

Freed by task 79:

kasan_save_stack+0x22/0x50

kasan_set_track+0x25/0x30

kasan_save_free_info+0x2e/0x50

__kasan_slab_free+0x10e/0x1a0

__kmem_cache_free+0x7a/0x1a0

cifs_readdata_release+0x49/0x60

process_one_work+0x46c/0x760

worker_thread+0x2a4/0x6f0

kthread+0x16b/0x1a0

ret_from_fork+0x2c/0x50

Last potentially related work creation:

kasan_save_stack+0x22/0x50

__kasan_record_aux_stack+0x95/0xb0

insert_work+0x2b/0x130

__queue_work+0x1fe/0x660

queue_work_on+0x4b/0x60

smb2_readv_callback+0x396/0x800

cifs_abort_connection+0x474/0x6a0

cifs_reconnect+0x5cb/0xa50

cifs_readv_from_socket.cold+0x22/0x6c

cifs_read_page_from_socket+0xc1/0x100

readpages_fill_pages.cold+0x2f/0x46

cifs_readv_receive+0x46d/0xa40

cifs_demultiplex_thread+0x121c/0x1490

kthread+0x16b/0x1a0

ret_from_fork+0x2c/0x50

The following function calls will cause UAF of the rdata pointer.

readpages_fill_pages

cifs_read_page_from_socket

cifs_readv_from_socket

cifs_reconnect

__cifs_reconnect

cifs_abort_connection

mid->callback() --> smb2_readv_callback

queue_work(&rdata->work) # if the worker completes first,

# the rdata is freed

cifs_readv_complete

kref_put

cifs_readdata_release

kfree(rdata)

return rdata->... # UAF in readpages_fill_pages()

Similarly, this problem also occurs in the uncache_fill_pages().

Fix this by adjusts the order of condition judgment in the return

statement.