From: "Theodore Y. Ts'o" <tytso@mit.edu>
To: Eric Biggers <ebiggers@kernel.org>
Cc: linux-ext4@vger.kernel.org, linux-fsdevel@vger.kernel.org,
linux-f2fs-devel@lists.sourceforge.net,
Alexander Viro <viro@zeniv.linux.org.uk>,
Daniel Rosenberg <drosen@google.com>,
Gabriel Krisman Bertazi <krisman@collabora.com>
Subject: Re: [PATCH] ext4: fix race conditions in ->d_compare() and ->d_hash()
Date: Fri, 24 Jan 2020 22:35:22 -0500 [thread overview]
Message-ID: <20200125033522.GM147870@mit.edu> (raw)
In-Reply-To: <20200124041234.159740-1-ebiggers@kernel.org>
On Thu, Jan 23, 2020 at 08:12:34PM -0800, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
>
> Since ->d_compare() and ->d_hash() can be called in RCU-walk mode,
> ->d_parent and ->d_inode can be concurrently modified, and in
> particular, ->d_inode may be changed to NULL. For ext4_d_hash() this
> resulted in a reproducible NULL dereference if a lookup is done in a
> directory being deleted, e.g. with:
>
> int main()
> {
> if (fork()) {
> for (;;) {
> mkdir("subdir", 0700);
> rmdir("subdir");
> }
> } else {
> for (;;)
> access("subdir/file", 0);
> }
> }
>
> ... or by running the 't_encrypted_d_revalidate' program from xfstests.
> Both repros work in any directory on a filesystem with the encoding
> feature, even if the directory doesn't actually have the casefold flag.
>
> I couldn't reproduce a crash in ext4_d_compare(), but it appears that a
> similar crash is possible there.
>
> Fix these bugs by reading ->d_parent and ->d_inode using READ_ONCE() and
> falling back to the case sensitive behavior if the inode is NULL.
>
> Reported-by: Al Viro <viro@zeniv.linux.org.uk>
> Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups")
> Cc: <stable@vger.kernel.org> # v5.2+
> Signed-off-by: Eric Biggers <ebiggers@google.com>
Thanks, applied.
- Ted
WARNING: multiple messages have this Message-ID (diff)
From: "Theodore Y. Ts'o" <tytso@mit.edu>
To: Eric Biggers <ebiggers@kernel.org>
Cc: Daniel Rosenberg <drosen@google.com>,
linux-f2fs-devel@lists.sourceforge.net,
Alexander Viro <viro@zeniv.linux.org.uk>,
linux-fsdevel@vger.kernel.org, linux-ext4@vger.kernel.org,
Gabriel Krisman Bertazi <krisman@collabora.com>
Subject: Re: [f2fs-dev] [PATCH] ext4: fix race conditions in ->d_compare() and ->d_hash()
Date: Fri, 24 Jan 2020 22:35:22 -0500 [thread overview]
Message-ID: <20200125033522.GM147870@mit.edu> (raw)
In-Reply-To: <20200124041234.159740-1-ebiggers@kernel.org>
On Thu, Jan 23, 2020 at 08:12:34PM -0800, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
>
> Since ->d_compare() and ->d_hash() can be called in RCU-walk mode,
> ->d_parent and ->d_inode can be concurrently modified, and in
> particular, ->d_inode may be changed to NULL. For ext4_d_hash() this
> resulted in a reproducible NULL dereference if a lookup is done in a
> directory being deleted, e.g. with:
>
> int main()
> {
> if (fork()) {
> for (;;) {
> mkdir("subdir", 0700);
> rmdir("subdir");
> }
> } else {
> for (;;)
> access("subdir/file", 0);
> }
> }
>
> ... or by running the 't_encrypted_d_revalidate' program from xfstests.
> Both repros work in any directory on a filesystem with the encoding
> feature, even if the directory doesn't actually have the casefold flag.
>
> I couldn't reproduce a crash in ext4_d_compare(), but it appears that a
> similar crash is possible there.
>
> Fix these bugs by reading ->d_parent and ->d_inode using READ_ONCE() and
> falling back to the case sensitive behavior if the inode is NULL.
>
> Reported-by: Al Viro <viro@zeniv.linux.org.uk>
> Fixes: b886ee3e778e ("ext4: Support case-insensitive file name lookups")
> Cc: <stable@vger.kernel.org> # v5.2+
> Signed-off-by: Eric Biggers <ebiggers@google.com>
Thanks, applied.
- Ted
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
next prev parent reply other threads:[~2020-01-25 3:35 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-24 4:12 [PATCH] ext4: fix race conditions in ->d_compare() and ->d_hash() Eric Biggers
2020-01-24 4:12 ` [f2fs-dev] " Eric Biggers
2020-01-24 5:04 ` Gao Xiang
2020-01-24 5:04 ` [f2fs-dev] " Gao Xiang via Linux-f2fs-devel
2020-01-24 5:16 ` Eric Biggers
2020-01-24 5:16 ` [f2fs-dev] " Eric Biggers
2020-01-24 5:27 ` Gao Xiang
2020-01-24 5:27 ` [f2fs-dev] " Gao Xiang via Linux-f2fs-devel
2020-01-24 5:53 ` Eric Biggers
2020-01-24 5:53 ` [f2fs-dev] " Eric Biggers
2020-01-24 5:34 ` Gao Xiang
2020-01-24 5:34 ` [f2fs-dev] " Gao Xiang via Linux-f2fs-devel
2020-01-24 5:42 ` Eric Biggers
2020-01-24 5:42 ` [f2fs-dev] " Eric Biggers
2020-01-24 6:15 ` Gao Xiang
2020-01-24 6:15 ` [f2fs-dev] " Gao Xiang via Linux-f2fs-devel
2020-01-24 18:12 ` Eric Biggers
2020-01-24 18:12 ` [f2fs-dev] " Eric Biggers
2020-01-24 18:31 ` Al Viro
2020-01-24 18:31 ` [f2fs-dev] " Al Viro
2020-01-25 3:35 ` Theodore Y. Ts'o [this message]
2020-01-25 3:35 ` Theodore Y. Ts'o
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200125033522.GM147870@mit.edu \
--to=tytso@mit.edu \
--cc=drosen@google.com \
--cc=ebiggers@kernel.org \
--cc=krisman@collabora.com \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-fsdevel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.