linux-kernel - ovl: fix BUG_ON() in may_delete() when called from ovl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <e6496a94-a161-dc04-c38a-d2544633acb4@bytedance.com>
Date:   Tue, 17 Aug 2021 13:41:11 +0800
From:   chenying <chenying.kernel@...edance.com>
To:     miklos@...redi.hu
Cc:     linux-unionfs@...r.kernel.org, linux-kernel@...r.kernel.org,
        zhoufeng.zf@...edance.com
Subject: ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup

 From ee4466d66af5d214edb306dbf7f456e21cbb73ac Mon Sep 17 00:00:00 2001
From: chenying <chenying.kernel@...edance.com>
Date: Mon, 16 Aug 2021 18:02:56 +0800
Subject: [PATCH] ovl: fix BUG_ON() in may_delete() when called from 
ovl_cleanup

If function ovl_instantiate returns an error, ovl_cleanup will be called
and try to remove newdentry from wdir, but the newdentry has been moved to
udir at this time. This will causes BUG_ON(victim->d_parent->d_inode !=
dir) in fs/namei.c:may_delete.

[25355953.608321] overlayfs: failed to get inode (-116)
[25355953.608337] ------------[ cut here ]------------
[25355953.608338] kernel BUG at fs/namei.c:2800!
[25355953.610787] invalid opcode: 0000 [#1] SMP NOPTI
[25355953.612694] CPU: 75 PID: 3739998 Comm: dockerd Kdump: loaded 
Tainted: G        W  OE     4.19.117.bsk.4-amd64 #4.19.117.bsk.4
[25355953.617046] Hardware name: Inspur NF5266M5/YZMB-01229-103, BIOS 
3.1.3 06/24/2020
[25355953.618920] RIP: 0010:may_delete+0x16f/0x190
[25355953.621120] Code: 00 3d 00 00 20 00 74 12 41 bd ec ff ff ff 5b 44 
89 e8 5d 41 5c 41 5d 41 5e c3 48 3b 5b 18 75 94 41 bd f0 ff ff ff eb a2 
0f 0b <0f> 0b 41 bd fe ff ff ff eb 96 41 bd eb ff ff ff eb 8e 41 bd b5 ff
[25355953.625147] RSP: 0018:ffff9aad5c09bb30 EFLAGS: 00010206
[25355953.627562] RAX: ffff8ebceb709b00 RBX: ffff8e73262c3800 RCX: 
0000000200000000
[25355953.629381] RDX: 0000000000000000 RSI: ffff8e73262c3800 RDI: 
ffff8e71e22b1ee0
[25355953.631562] RBP: ffff8e71e22b3000 R08: 0000000000000038 R09: 
ffff8e73262c2300
[25355953.633571] R10: ffff9aad5c09bae0 R11: 0000000000000000 R12: 
ffff8e71e22b4568
[25355953.635193] R13: ffff8e71e22b3000 R14: ffff8ebceb709080 R15: 
0000000000000000
[25355953.637280] FS:  00007f3e77fff700(0000) GS:ffff8eceff6c0000(0000) 
knlGS:0000000000000000
[25355953.639360] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[25355953.640935] CR2: 0000000017fe3000 CR3: 0000000161380004 CR4: 
00000000007606e0
[25355953.642878] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 
0000000000000000
[25355953.644835] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 
0000000000000400
[25355953.646305] PKRU: 55555554
[25355953.647995] Call Trace:
[25355953.649891]  vfs_unlink+0x23/0x180
[25355953.651891]  ovl_cleanup+0x36/0xb0 [overlay]
[25355953.653682]  ovl_create_or_link+0x47a/0x600 [overlay]
[25355953.655569]  ? inode_init_always+0x13e/0x1f0
[25355953.657377]  ? inode_sb_list_add+0x47/0x80
[25355953.659083]  ? ovl_fill_inode+0x34/0x130 [overlay]
[25355953.660730]  ovl_create_object+0xd9/0x110 [overlay]
[25355953.662392]  path_openat+0x1351/0x1430
[25355953.663961]  ? terminate_walk+0xdd/0x100
[25355953.665605]  ? ext4_getattr+0x7f/0x90 [ext4]
[25355953.667019]  ? ovl_getattr+0x138/0x3c0 [overlay]
[25355953.668075]  do_filp_open+0x99/0x110
[25355953.669180]  ? __check_object_size+0x166/0x1b0
[25355953.670485]  ? do_sys_open+0x12e/0x210
[25355953.671811]  do_sys_open+0x12e/0x210
[25355953.672966]  do_syscall_64+0x5d/0x110
[25355953.673880]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Signed-off-by: chenying <chenying.kernel@...edance.com>
---
  fs/overlayfs/dir.c | 6 ++++--
  1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 93efe7048a77..7c1850adec28 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -542,8 +542,10 @@ static int ovl_create_over_whiteout(struct dentry 
*dentry, struct inode *inode,
                         goto out_cleanup;
         }
         err = ovl_instantiate(dentry, inode, newdentry, hardlink);
-       if (err)
-               goto out_cleanup;
+       if (err) {
+               ovl_cleanup(udir, newdentry);
+               dput(newdentry);
+       }
  out_dput:
         dput(upper);
  out_unlock:
--
2.11.0