* [PATCH] ovl: Fix use inode directly in rcu-walk mode
@ 2022-11-24 9:26 Chen Zhongjin
2022-11-24 12:45 ` Miklos Szeredi
0 siblings, 1 reply; 3+ messages in thread
From: Chen Zhongjin @ 2022-11-24 9:26 UTC (permalink / raw)
To: syzbot+a4055c78774bbf3498bb, linux-unionfs, linux-kernel
Cc: chenzhongjin, miklos
syzkaller reported a null-ptr-deref error:
https://syzkaller.appspot.com/bug?id=bb281e89381b9ed55728c274447a575e69a96c35
ovl_dentry_revalidate_common() can be called in rcu-walk mode.
As document said, "in rcu-walk mode, d_parent and d_inode should not be
used without care". Check inode here to protect access under rcu-walk
mode.
Fixes: bccece1ead36 ("ovl: allow remote upper")
Reported-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
---
fs/overlayfs/super.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index a29a8afe9b26..d61ab192dfd9 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -139,11 +139,19 @@ static int ovl_dentry_revalidate_common(struct dentry *dentry,
unsigned int flags, bool weak)
{
struct ovl_entry *oe = dentry->d_fsdata;
+ struct inode *inode;
struct dentry *upper;
unsigned int i;
int ret = 1;
- upper = ovl_dentry_upper(dentry);
+ if (flags & LOOKUP_RCU) {
+ inode = d_inode_rcu(dentry);
+ if (!inode)
+ return -ECHILD;
+ upper = ovl_upperdentry_dereference(OVL_I(inode));
+ } else
+ upper = ovl_dentry_upper(dentry);
+
if (upper)
ret = ovl_revalidate_real(upper, flags, weak);
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] ovl: Fix use inode directly in rcu-walk mode
2022-11-24 9:26 [PATCH] ovl: Fix use inode directly in rcu-walk mode Chen Zhongjin
@ 2022-11-24 12:45 ` Miklos Szeredi
2022-11-24 13:18 ` Chen Zhongjin
0 siblings, 1 reply; 3+ messages in thread
From: Miklos Szeredi @ 2022-11-24 12:45 UTC (permalink / raw)
To: Chen Zhongjin; +Cc: syzbot+a4055c78774bbf3498bb, linux-unionfs, linux-kernel
On Thu, Nov 24, 2022 at 05:26:02PM +0800, Chen Zhongjin wrote:
> syzkaller reported a null-ptr-deref error:
> https://syzkaller.appspot.com/bug?id=bb281e89381b9ed55728c274447a575e69a96c35
>
> ovl_dentry_revalidate_common() can be called in rcu-walk mode.
> As document said, "in rcu-walk mode, d_parent and d_inode should not be
> used without care". Check inode here to protect access under rcu-walk
> mode.
>
> Fixes: bccece1ead36 ("ovl: allow remote upper")
> Reported-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com
> Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Hi,
Thanks for the quick analysis and patch.
I simplified the patch a bit without changing the attribution.
Thanks,
Miklos
----
From: Chen Zhongjin <chenzhongjin@huawei.com>
Subject: ovl: fix use inode directly in rcu-walk mode
ovl_dentry_revalidate_common() can be called in rcu-walk mode. As document
said, "in rcu-walk mode, d_parent and d_inode should not be used without
care".
Check inode here to protect access under rcu-walk mode.
Fixes: bccece1ead36 ("ovl: allow remote upper")
Reported-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Cc: <stable@vger.kernel.org> # v5.7
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
---
fs/overlayfs/super.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -139,11 +139,16 @@ static int ovl_dentry_revalidate_common(
unsigned int flags, bool weak)
{
struct ovl_entry *oe = dentry->d_fsdata;
+ struct inode *inode = d_inode_rcu(dentry);
struct dentry *upper;
unsigned int i;
int ret = 1;
- upper = ovl_dentry_upper(dentry);
+ /* Careful in RCU mode */
+ if (!inode)
+ return -ECHILD;
+
+ upper = ovl_i_dentry_upper(inode);
if (upper)
ret = ovl_revalidate_real(upper, flags, weak);
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] ovl: Fix use inode directly in rcu-walk mode
2022-11-24 12:45 ` Miklos Szeredi
@ 2022-11-24 13:18 ` Chen Zhongjin
0 siblings, 0 replies; 3+ messages in thread
From: Chen Zhongjin @ 2022-11-24 13:18 UTC (permalink / raw)
To: Miklos Szeredi; +Cc: syzbot+a4055c78774bbf3498bb, linux-unionfs, linux-kernel
On 2022/11/24 20:45, Miklos Szeredi wrote:
> On Thu, Nov 24, 2022 at 05:26:02PM +0800, Chen Zhongjin wrote:
>> syzkaller reported a null-ptr-deref error:
>> https://syzkaller.appspot.com/bug?id=bb281e89381b9ed55728c274447a575e69a96c35
>>
>> ovl_dentry_revalidate_common() can be called in rcu-walk mode.
>> As document said, "in rcu-walk mode, d_parent and d_inode should not be
>> used without care". Check inode here to protect access under rcu-walk
>> mode.
>>
>> Fixes: bccece1ead36 ("ovl: allow remote upper")
>> Reported-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com
>> Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
> Hi,
>
> Thanks for the quick analysis and patch.
>
> I simplified the patch a bit without changing the attribution.
>
> Thanks,
> Miklos
>
> ----
> From: Chen Zhongjin <chenzhongjin@huawei.com>
> Subject: ovl: fix use inode directly in rcu-walk mode
>
> ovl_dentry_revalidate_common() can be called in rcu-walk mode. As document
> said, "in rcu-walk mode, d_parent and d_inode should not be used without
> care".
>
> Check inode here to protect access under rcu-walk mode.
>
> Fixes: bccece1ead36 ("ovl: allow remote upper")
> Reported-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com
> Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
> Cc: <stable@vger.kernel.org> # v5.7
> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
> ---
> fs/overlayfs/super.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> --- a/fs/overlayfs/super.c
> +++ b/fs/overlayfs/super.c
> @@ -139,11 +139,16 @@ static int ovl_dentry_revalidate_common(
> unsigned int flags, bool weak)
> {
> struct ovl_entry *oe = dentry->d_fsdata;
> + struct inode *inode = d_inode_rcu(dentry);
> struct dentry *upper;
> unsigned int i;
> int ret = 1;
>
> - upper = ovl_dentry_upper(dentry);
> + /* Careful in RCU mode */
> + if (!inode)
> + return -ECHILD;
> +
> + upper = ovl_i_dentry_upper(inode);
> if (upper)
> ret = ovl_revalidate_real(upper, flags, weak);
>
Thanks for review! LGTM
Best,
Chen
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-11-24 13:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-24 9:26 [PATCH] ovl: Fix use inode directly in rcu-walk mode Chen Zhongjin
2022-11-24 12:45 ` Miklos Szeredi
2022-11-24 13:18 ` Chen Zhongjin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).