lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 14 Apr 2021 21:47:35 +0800 From: Zhang Yi <yi.zhang@...wei.com> To: <linux-ext4@...r.kernel.org> CC: <linux-fsdevel@...r.kernel.org>, <tytso@....edu>, <adilger.kernel@...ger.ca>, <jack@...e.cz>, <yi.zhang@...wei.com>, <yukuai3@...wei.com> Subject: [RFC PATCH v2 5/7] ext4: use RCU to protect accessing superblock in blkdev_releasepage() In blkdev_releasepage() we access the superblock structure directly, it could be raced by umount filesystem on destroy superblock in put_super(), and end up triggering a use after free issue. drop cache umount filesystem bdev_try_to_free_page() get superblock deactivate_locked_super() ... put_super() and free sb by destroy_work access superblock <-- trigger use after free This issue doesn't trigger easily in general because we get page locked when invoking bdev_try_to_free_page(), and when umount filesystem the kill_block_super()->..->kill_bdev()->truncate_inode_pages_range() procedure wait on page unlock, but it's not a guarantee. Fix this race by use RCU to protect superblock in blkdev_releasepage(). Fixes: 87d8fe1ee6b8 ("add releasepage hooks to block devices which can be used by file systems") Reported-by: Jan Kara <jack@...e.cz> Signed-off-by: Zhang Yi <yi.zhang@...wei.com> --- fs/block_dev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/block_dev.c b/fs/block_dev.c index 5ed79a9063f6..cb84f347fb04 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -1734,11 +1734,14 @@ EXPORT_SYMBOL_GPL(blkdev_read_iter); */ static int blkdev_releasepage(struct page *page, gfp_t wait) { - struct super_block *super = BDEV_I(page->mapping->host)->bdev.bd_super; + struct super_block *super; int ret = 0; + rcu_read_lock(); + super = READ_ONCE(BDEV_I(page->mapping->host)->bdev.bd_super); if (super && super->s_op->bdev_try_to_free_page) ret = super->s_op->bdev_try_to_free_page(super, page, wait); + rcu_read_unlock(); if (!ret) return try_to_free_buffers(page); return 0; -- 2.25.4
Powered by blists - more mailing lists