linux-kernel - [PATCH 2 0/2] xfs: fix inline link path race

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 15 Nov 2021 10:24:16 +0800
From:   Ian Kent <raven@...maw.net>
To:     xfs <linux-xfs@...r.kernel.org>,
        "Darrick J. Wong" <djwong@...nel.org>,
        Christoph Hellwig <hch@....de>
Cc:     Miklos Szeredi <miklos@...redi.hu>,
        Brian Foster <bfoster@...hat.com>,
        Al Viro <viro@...IV.linux.org.uk>,
        David Howells <dhowells@...hat.com>,
        linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: [PATCH 2 0/2] xfs: fix inline link path race

If the inode of an inline symlink is released (dropped) while a path walk
that is in rcu-walk mode is occuring the inode ->get_link() method can be
NULL when VFS dereferences it causing a crash. But, since the release can
occur at any time there's a small but finite possibility the link path
text could be freed while it's being used.

Changes since v1:
- don't bother trying to rcu-free the link path since there could
  be side effects from the xfs reclaim code.
---

Ian Kent (2):
      vfs: check dentry is still valid in get_link()
      xfs: make sure link path does not go away at access


 fs/xfs/xfs_iops.c | 3 +++
 1 file changed, 3 insertions(+)

--
Ian