Re: [PATCH] ovl: check VM_DENYWRITE mappings in copy-up

[Miklos Szeredi <miklos@szeredi.hu>]

[-- Attachment #1: Type: text/plain, Size: 1970 bytes --]

On Thu, Apr 8, 2021 at 1:40 PM Chengguang Xu <cgxu519@mykernel.net> wrote:
>
>  ---- 在 星期四, 2021-04-08 19:29:55 Miklos Szeredi <miklos@szeredi.hu> 撰写 ----
>  > On Thu, Apr 8, 2021 at 1:28 PM Chengguang Xu <cgxu519@mykernel.net> wrote:
>  > >
>  > >  ---- 在 星期四, 2021-04-08 19:20:42 Chengguang Xu <cgxu519@mykernel.net> 撰写 ----
>  > >  > In overlayfs copy-up, if open flag has O_TRUNC then upper
>  > >  > file will truncate to zero size, in this case we should check
>  > >  > VM_DENYWRITE mappings to keep compatibility with other filesystems.
>  >
>  > Can you provide a test case for the bug that this is fixing?
>  >
>
> Execute binary file(keep running until open) in overlayfs which only has lower && open the binary file with flag O_RDWR|O_TRUNC
>
> Expected result: open fail with -ETXTBSY
>
> Actual result: open success

Worse,  it's possible to get a "Bus error" with just execute and write
on an overlayfs file, which i_writecount is supposed to protect.

The reason is that the put_write_access() call in __vma_link_file()
assumes an already negative writecount, but because of the vm_file
shuffle in ovl_mmap() that's not guaranteed.   There's even a comment
about exactly this situation in mmap():

/* ->mmap() can change vma->vm_file, but must guarantee that
* vma_link() below can deny write-access if VM_DENYWRITE is set
* and map writably if VM_SHARED is set. This usually means the
* new file must not have been exposed to user-space, yet.
*/

The attached patch fixes this, but not your original bug.

That could be addressed by checking the writecount on *both* lower and
upper for open for write/truncate.  Note: this could be checked before
copy-up, but that's not reliable alone, because the copy up could
happen due to meta-data update, for example, and then the
open/truncate wouldn't trigger the writecount check.

Something like the second attached patch?

Thanks,
Miklos

[-- Attachment #2: test.patch --]
[-- Type: text/x-patch, Size: 2107 bytes --]

diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
index dbfb35fb0ff7..5b5b4410c0f4 100644
--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -422,6 +422,7 @@ static int ovl_mmap(struct file *file, struct vm_area_struct *vma)
 {
 	struct file *realfile = file->private_data;
 	const struct cred *old_cred;
+	vm_flags_t vm_flags = vma->vm_flags;
 	int ret;
 
 	if (!realfile->f_op->mmap)
@@ -430,6 +431,15 @@ static int ovl_mmap(struct file *file, struct vm_area_struct *vma)
 	if (WARN_ON(file != vma->vm_file))
 		return -EIO;
 
+	/* Get temporary denial counts on realfile */
+	if (vm_flags & VM_DENYWRITE &&
+	    (ret = deny_write_access(realfile)))
+		goto out;
+
+	if (vm_flags & VM_SHARED &&
+	    (ret = mapping_map_writable(file->f_mapping)))
+		goto allow_write;
+
 	vma->vm_file = get_file(realfile);
 
 	old_cred = ovl_override_creds(file_inode(file)->i_sb);
@@ -446,6 +456,13 @@ static int ovl_mmap(struct file *file, struct vm_area_struct *vma)
 
 	ovl_file_accessed(file);
 
+	/* Undo temporary denial counts */
+	if (vm_flags & VM_SHARED)
+		mapping_unmap_writable(realfile->f_mapping);
+allow_write:
+	if (vm_flags & VM_DENYWRITE)
+		allow_write_access(realfile);
+out:
 	return ret;
 }
 
diff --git a/mm/mmap.c b/mm/mmap.c
index 3f287599a7a3..15b082c701c7 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -659,11 +659,18 @@ static void __vma_link_file(struct vm_area_struct *vma)
 	file = vma->vm_file;
 	if (file) {
 		struct address_space *mapping = file->f_mapping;
+		struct inode *inode = file_inode(file);
 
-		if (vma->vm_flags & VM_DENYWRITE)
-			put_write_access(file_inode(file));
-		if (vma->vm_flags & VM_SHARED)
+		if (vma->vm_flags & VM_DENYWRITE) {
+			/* This is an unconditional deny_write_access() */
+			WARN_ON(atomic_read(&inode->i_writecount) > 0);
+			put_write_access(inode);
+		}
+		if (vma->vm_flags & VM_SHARED) {
+			/* This is an unconditional mapping_map_writable() */
+			WARN_ON(atomic_read(&mapping->i_mmap_writable) < 0);
 			mapping_allow_writable(mapping);
+		}
 
 		flush_dcache_mmap_lock(mapping);
 		vma_interval_tree_insert(vma, &mapping->i_mmap);

[-- Attachment #3: ovl-check-writecount-on-underlying-inodes.patch --]
[-- Type: text/x-patch, Size: 773 bytes --]

diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
index dbfb35fb0ff7..504107dd6bab 100644
--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -144,8 +144,17 @@ static int ovl_real_fdget(const struct file *file, struct fd *real)
 static int ovl_open(struct inode *inode, struct file *file)
 {
 	struct file *realfile;
+	struct inode *lowerinode, *upperinode;
 	int err;
 
+	lowerinode = ovl_inode_lower(inode);
+	upperinode = ovl_inode_upper(inode);
+
+	if (((file->f_mode & FMODE_WRITE) || file->f_flags & O_TRUNC) && 
+	    ((lowerinode && atomic_read(&lowerinode->i_writecount) < 0) ||
+	     (upperinode && atomic_read(&upperinode->i_writecount) < 0)))
+		return -ETXTBSY;
+
 	err = ovl_maybe_copy_up(file_dentry(file), file->f_flags);
 	if (err)
 		return err;