linux-kernel - Re: ovl: fix BUG_ON() in may_delete() when called from ovl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJfpegt_EZRPbQLbcHRXD9Yx9zvcKmgos=u79k=kgKwd0LWzaA@mail.gmail.com>
Date:   Tue, 17 Aug 2021 17:39:13 +0200
From:   Miklos Szeredi <miklos@...redi.hu>
To:     chenying <chenying.kernel@...edance.com>
Cc:     overlayfs <linux-unionfs@...r.kernel.org>,
        linux-kernel@...r.kernel.org, zhoufeng.zf@...edance.com
Subject: Re: ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup

On Tue, 17 Aug 2021 at 07:41, chenying <chenying.kernel@...edance.com> wrote:
>
>  From ee4466d66af5d214edb306dbf7f456e21cbb73ac Mon Sep 17 00:00:00 2001
> From: chenying <chenying.kernel@...edance.com>
> Date: Mon, 16 Aug 2021 18:02:56 +0800
> Subject: [PATCH] ovl: fix BUG_ON() in may_delete() when called from
> ovl_cleanup
>
> If function ovl_instantiate returns an error, ovl_cleanup will be called
> and try to remove newdentry from wdir, but the newdentry has been moved to
> udir at this time. This will causes BUG_ON(victim->d_parent->d_inode !=
> dir) in fs/namei.c:may_delete.
>
> [25355953.608321] overlayfs: failed to get inode (-116)
> [25355953.608337] ------------[ cut here ]------------
> [25355953.608338] kernel BUG at fs/namei.c:2800!
> [25355953.610787] invalid opcode: 0000 [#1] SMP NOPTI
> [25355953.612694] CPU: 75 PID: 3739998 Comm: dockerd Kdump: loaded
> Tainted: G        W  OE     4.19.117.bsk.4-amd64 #4.19.117.bsk.4
> [25355953.617046] Hardware name: Inspur NF5266M5/YZMB-01229-103, BIOS
> 3.1.3 06/24/2020
> [25355953.618920] RIP: 0010:may_delete+0x16f/0x190
> [25355953.621120] Code: 00 3d 00 00 20 00 74 12 41 bd ec ff ff ff 5b 44
> 89 e8 5d 41 5c 41 5d 41 5e c3 48 3b 5b 18 75 94 41 bd f0 ff ff ff eb a2
> 0f 0b <0f> 0b 41 bd fe ff ff ff eb 96 41 bd eb ff ff ff eb 8e 41 bd b5 ff
> [25355953.625147] RSP: 0018:ffff9aad5c09bb30 EFLAGS: 00010206
> [25355953.627562] RAX: ffff8ebceb709b00 RBX: ffff8e73262c3800 RCX:
> 0000000200000000
> [25355953.629381] RDX: 0000000000000000 RSI: ffff8e73262c3800 RDI:
> ffff8e71e22b1ee0
> [25355953.631562] RBP: ffff8e71e22b3000 R08: 0000000000000038 R09:
> ffff8e73262c2300
> [25355953.633571] R10: ffff9aad5c09bae0 R11: 0000000000000000 R12:
> ffff8e71e22b4568
> [25355953.635193] R13: ffff8e71e22b3000 R14: ffff8ebceb709080 R15:
> 0000000000000000
> [25355953.637280] FS:  00007f3e77fff700(0000) GS:ffff8eceff6c0000(0000)
> knlGS:0000000000000000
> [25355953.639360] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [25355953.640935] CR2: 0000000017fe3000 CR3: 0000000161380004 CR4:
> 00000000007606e0
> [25355953.642878] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
> 0000000000000000
> [25355953.644835] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
> 0000000000000400
> [25355953.646305] PKRU: 55555554
> [25355953.647995] Call Trace:
> [25355953.649891]  vfs_unlink+0x23/0x180
> [25355953.651891]  ovl_cleanup+0x36/0xb0 [overlay]
> [25355953.653682]  ovl_create_or_link+0x47a/0x600 [overlay]
> [25355953.655569]  ? inode_init_always+0x13e/0x1f0
> [25355953.657377]  ? inode_sb_list_add+0x47/0x80
> [25355953.659083]  ? ovl_fill_inode+0x34/0x130 [overlay]
> [25355953.660730]  ovl_create_object+0xd9/0x110 [overlay]
> [25355953.662392]  path_openat+0x1351/0x1430
> [25355953.663961]  ? terminate_walk+0xdd/0x100
> [25355953.665605]  ? ext4_getattr+0x7f/0x90 [ext4]
> [25355953.667019]  ? ovl_getattr+0x138/0x3c0 [overlay]
> [25355953.668075]  do_filp_open+0x99/0x110
> [25355953.669180]  ? __check_object_size+0x166/0x1b0
> [25355953.670485]  ? do_sys_open+0x12e/0x210
> [25355953.671811]  do_sys_open+0x12e/0x210
> [25355953.672966]  do_syscall_64+0x5d/0x110
> [25355953.673880]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> Signed-off-by: chenying <chenying.kernel@...edance.com>

Thanks, applied.

Miklos