From: David Howells <dhowells@redhat.com> To: Christian Brauner <christian@brauner.io> Cc: David Howells <dhowells@redhat.com>, Jeff Layton <jlayton@kernel.org>, Matthew Wilcox <willy@infradead.org>, netfs@lists.linux.dev, linux-afs@lists.infradead.org, linux-cifs@vger.kernel.org, linux-nfs@vger.kernel.org, ceph-devel@vger.kernel.org, v9fs@lists.linux.dev, linux-erofs@lists.ozlabs.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Marc Dionne <marc.dionne@auristor.com>, Gao Xiang <xiang@kernel.org>, Chao Yu <chao@kernel.org>, Yue Hu <huyue2@coolpad.com>, Jeffle Xu <jefflexu@linux.alibaba.com> Subject: [PATCH 06/10] cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode Date: Mon, 22 Jan 2024 12:38:39 +0000 [thread overview] Message-ID: <20240122123845.3822570-7-dhowells@redhat.com> (raw) In-Reply-To: <20240122123845.3822570-1-dhowells@redhat.com> cachefiles_ondemand_init_object() as called from cachefiles_open_file() and cachefiles_create_tmpfile() does not check if object->ondemand is set before dereferencing it, leading to an oops something like: RIP: 0010:cachefiles_ondemand_init_object+0x9/0x41 ... Call Trace: <TASK> cachefiles_open_file+0xc9/0x187 cachefiles_lookup_cookie+0x122/0x2be fscache_cookie_state_machine+0xbe/0x32b fscache_cookie_worker+0x1f/0x2d process_one_work+0x136/0x208 process_scheduled_works+0x3a/0x41 worker_thread+0x1a2/0x1f6 kthread+0xca/0xd2 ret_from_fork+0x21/0x33 Fix this by making the calls to cachefiles_ondemand_init_object() conditional. Fixes: 3c5ecfe16e76 ("cachefiles: extract ondemand info field from cachefiles_object") Reported-by: Marc Dionne <marc.dionne@auristor.com> Signed-off-by: David Howells <dhowells@redhat.com> cc: Gao Xiang <xiang@kernel.org> cc: Chao Yu <chao@kernel.org> cc: Yue Hu <huyue2@coolpad.com> cc: Jeffle Xu <jefflexu@linux.alibaba.com> cc: linux-erofs@lists.ozlabs.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org --- fs/cachefiles/namei.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c index 7ade836beb58..180594d24c44 100644 --- a/fs/cachefiles/namei.c +++ b/fs/cachefiles/namei.c @@ -473,9 +473,11 @@ struct file *cachefiles_create_tmpfile(struct cachefiles_object *object) if (!cachefiles_mark_inode_in_use(object, file_inode(file))) WARN_ON(1); - ret = cachefiles_ondemand_init_object(object); - if (ret < 0) - goto err_unuse; + if (object->ondemand) { + ret = cachefiles_ondemand_init_object(object); + if (ret < 0) + goto err_unuse; + } ni_size = object->cookie->object_size; ni_size = round_up(ni_size, CACHEFILES_DIO_BLOCK_SIZE); @@ -579,9 +581,11 @@ static bool cachefiles_open_file(struct cachefiles_object *object, } _debug("file -> %pd positive", dentry); - ret = cachefiles_ondemand_init_object(object); - if (ret < 0) - goto error_fput; + if (object->ondemand) { + ret = cachefiles_ondemand_init_object(object); + if (ret < 0) + goto error_fput; + } ret = cachefiles_check_auxdata(object, file); if (ret < 0)
WARNING: multiple messages have this Message-ID (diff)
From: David Howells <dhowells@redhat.com> To: Christian Brauner <christian@brauner.io> Cc: linux-cifs@vger.kernel.org, linux-nfs@vger.kernel.org, v9fs@lists.linux.dev, Jeff Layton <jlayton@kernel.org>, linux-kernel@vger.kernel.org, Matthew Wilcox <willy@infradead.org>, David Howells <dhowells@redhat.com>, linux-mm@kvack.org, Yue Hu <huyue2@coolpad.com>, linux-fsdevel@vger.kernel.org, netfs@lists.linux.dev, ceph-devel@vger.kernel.org, linux-erofs@lists.ozlabs.org, linux-afs@lists.infradead.org, Marc Dionne <marc.dionne@auristor.com> Subject: [PATCH 06/10] cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode Date: Mon, 22 Jan 2024 12:38:39 +0000 [thread overview] Message-ID: <20240122123845.3822570-7-dhowells@redhat.com> (raw) In-Reply-To: <20240122123845.3822570-1-dhowells@redhat.com> cachefiles_ondemand_init_object() as called from cachefiles_open_file() and cachefiles_create_tmpfile() does not check if object->ondemand is set before dereferencing it, leading to an oops something like: RIP: 0010:cachefiles_ondemand_init_object+0x9/0x41 ... Call Trace: <TASK> cachefiles_open_file+0xc9/0x187 cachefiles_lookup_cookie+0x122/0x2be fscache_cookie_state_machine+0xbe/0x32b fscache_cookie_worker+0x1f/0x2d process_one_work+0x136/0x208 process_scheduled_works+0x3a/0x41 worker_thread+0x1a2/0x1f6 kthread+0xca/0xd2 ret_from_fork+0x21/0x33 Fix this by making the calls to cachefiles_ondemand_init_object() conditional. Fixes: 3c5ecfe16e76 ("cachefiles: extract ondemand info field from cachefiles_object") Reported-by: Marc Dionne <marc.dionne@auristor.com> Signed-off-by: David Howells <dhowells@redhat.com> cc: Gao Xiang <xiang@kernel.org> cc: Chao Yu <chao@kernel.org> cc: Yue Hu <huyue2@coolpad.com> cc: Jeffle Xu <jefflexu@linux.alibaba.com> cc: linux-erofs@lists.ozlabs.org cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org --- fs/cachefiles/namei.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c index 7ade836beb58..180594d24c44 100644 --- a/fs/cachefiles/namei.c +++ b/fs/cachefiles/namei.c @@ -473,9 +473,11 @@ struct file *cachefiles_create_tmpfile(struct cachefiles_object *object) if (!cachefiles_mark_inode_in_use(object, file_inode(file))) WARN_ON(1); - ret = cachefiles_ondemand_init_object(object); - if (ret < 0) - goto err_unuse; + if (object->ondemand) { + ret = cachefiles_ondemand_init_object(object); + if (ret < 0) + goto err_unuse; + } ni_size = object->cookie->object_size; ni_size = round_up(ni_size, CACHEFILES_DIO_BLOCK_SIZE); @@ -579,9 +581,11 @@ static bool cachefiles_open_file(struct cachefiles_object *object, } _debug("file -> %pd positive", dentry); - ret = cachefiles_ondemand_init_object(object); - if (ret < 0) - goto error_fput; + if (object->ondemand) { + ret = cachefiles_ondemand_init_object(object); + if (ret < 0) + goto error_fput; + } ret = cachefiles_check_auxdata(object, file); if (ret < 0)
next prev parent reply other threads:[~2024-01-22 12:39 UTC|newest] Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top 2024-01-22 12:38 [PATCH 00/10] netfs, afs, cifs, cachefiles, erofs: Miscellaneous fixes David Howells 2024-01-22 12:38 ` David Howells 2024-01-22 12:38 ` [PATCH 01/10] netfs: Don't use certain internal folio_*() functions David Howells 2024-01-22 12:38 ` David Howells 2024-01-22 15:38 ` Jeff Layton 2024-01-22 15:38 ` Jeff Layton 2024-01-22 16:10 ` Matthew Wilcox 2024-01-22 16:10 ` Matthew Wilcox 2024-01-22 17:22 ` David Howells 2024-01-22 17:22 ` David Howells 2024-01-22 12:38 ` [PATCH 02/10] afs: " David Howells 2024-01-22 12:38 ` David Howells 2024-01-22 12:38 ` [PATCH 03/10] cifs: " David Howells 2024-01-22 12:38 ` David Howells 2024-01-22 12:38 ` [PATCH 04/10] netfs, fscache: Prevent Oops in fscache_put_cache() David Howells 2024-01-22 12:38 ` David Howells 2024-01-22 12:38 ` [PATCH 05/10] netfs: Fix a NULL vs IS_ERR() check in netfs_perform_write() David Howells 2024-01-22 12:38 ` David Howells 2024-01-22 12:38 ` David Howells [this message] 2024-01-22 12:38 ` [PATCH 06/10] cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode David Howells 2024-01-22 13:48 ` Jingbo Xu 2024-01-22 13:48 ` Jingbo Xu 2024-01-22 15:27 ` Gao Xiang 2024-01-22 15:27 ` Gao Xiang 2024-01-22 22:01 ` David Howells 2024-01-22 22:01 ` David Howells 2024-01-22 12:38 ` [PATCH 07/10] afs: Hide silly-rename files from userspace David Howells 2024-01-22 12:38 ` David Howells 2024-01-22 12:38 ` [PATCH 08/10] afs: Fix error handling with lookup via FS.InlineBulkStatus David Howells 2024-01-22 12:38 ` David Howells 2024-01-22 12:38 ` [PATCH 09/10] afs: Remove afs_dynroot_d_revalidate() as it is redundant David Howells 2024-01-22 12:38 ` David Howells 2024-01-22 12:38 ` [PATCH 10/10] afs: Fix missing/incorrect unlocking of RCU read lock David Howells 2024-01-22 12:38 ` David Howells 2024-01-22 15:18 ` [PATCH 00/10] netfs, afs, cifs, cachefiles, erofs: Miscellaneous fixes Christian Brauner 2024-01-22 15:18 ` Christian Brauner 2024-01-23 15:03 ` Christian Brauner 2024-01-23 15:03 ` Christian Brauner 2024-01-22 15:57 ` Jeff Layton 2024-01-22 15:57 ` Jeff Layton
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20240122123845.3822570-7-dhowells@redhat.com \ --to=dhowells@redhat.com \ --cc=ceph-devel@vger.kernel.org \ --cc=chao@kernel.org \ --cc=christian@brauner.io \ --cc=huyue2@coolpad.com \ --cc=jefflexu@linux.alibaba.com \ --cc=jlayton@kernel.org \ --cc=linux-afs@lists.infradead.org \ --cc=linux-cifs@vger.kernel.org \ --cc=linux-erofs@lists.ozlabs.org \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=linux-nfs@vger.kernel.org \ --cc=marc.dionne@auristor.com \ --cc=netfs@lists.linux.dev \ --cc=v9fs@lists.linux.dev \ --cc=willy@infradead.org \ --cc=xiang@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.