linux-kernel - Re: [PATCH v2] fs: do not update freeing inode io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 15 Nov 2022 22:28:55 +0200
From:   Svyatoslav Feldsherov <feldsherov@...gle.com>
To:     Jan Kara <jack@...e.cz>
Cc:     Alexander Viro <viro@...iv.linux.org.uk>,
        Lukas Czerner <lczerner@...hat.com>,
        "Theodore Ts'o" <tytso@....edu>,
        syzbot+6ba92bd00d5093f7e371@...kaller.appspotmail.com,
        oferz@...gle.com, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] fs: do not update freeing inode io_list

Thank you for the review.

I've sent v3 with proposed fixes.
Also tried to be more consistent and use i_io_list in comments and
commit message instead of io_list//io list.

On Tue, Nov 15, 2022 at 12:55 PM Jan Kara <jack@...e.cz> wrote:
>
> On Mon 14-11-22 21:21:55, Svyatoslav Feldsherov wrote:
> > After commit cbfecb927f42 ("fs: record I_DIRTY_TIME even if inode
> > already has I_DIRTY_INODE") writeiback_single_inode can push inode with
>                                 ^^^ writeback
>
> > I_DIRTY_TIME set to b_dirty_time list. In case of freeing inode with
> > I_DIRTY_TIME set this can happened after deletion of inode io_list at
>                                 ^^ happen               ^^^ deletion of
> inode *from i_io_list*
>
> > evict. Stack trace is following.
> >
> > evict
> > fat_evict_inode
> > fat_truncate_blocks
> > fat_flush_inodes
> > writeback_inode
> > sync_inode_metadata(inode, sync=0)
> > writeback_single_inode(inode, wbc) <- wbc->sync_mode == WB_SYNC_NONE
> >
> > This will lead to use after free in flusher thread.
> >
> > Similar issue can be triggered if writeback_single_inode in the
> > stack trace update inode->io_list. Add explicit check to avoid it.
>                         ^^ inode->i_io_list
>
> > Fixes: cbfecb927f42 ("fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE")
> > Reported-by: syzbot+6ba92bd00d5093f7e371@...kaller.appspotmail.com
> > Signed-off-by: Svyatoslav Feldsherov <feldsherov@...gle.com>
>
> Besides these gramatical nits the patch looks good to me. Feel free to add:
>
> Reviewed-by: Jan Kara <jack@...e.cz>
>
> Thanks!
>
>                                                                 Honza
>
> > ---
> >  V1 -> V2:
> >  - address review comments
> >  - skip inode_cgwb_move_to_attached for freeing inode
> >
> >  fs/fs-writeback.c | 30 +++++++++++++++++++-----------
> >  1 file changed, 19 insertions(+), 11 deletions(-)
> >
> > diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
> > index 443f83382b9b..c4aea096689c 100644
> > --- a/fs/fs-writeback.c
> > +++ b/fs/fs-writeback.c
> > @@ -1712,18 +1712,26 @@ static int writeback_single_inode(struct inode *inode,
> >       wb = inode_to_wb_and_lock_list(inode);
> >       spin_lock(&inode->i_lock);
> >       /*
> > -      * If the inode is now fully clean, then it can be safely removed from
> > -      * its writeback list (if any).  Otherwise the flusher threads are
> > -      * responsible for the writeback lists.
> > +      * If the inode is freeing, it's io_list shoudn't be updated
> > +      * as it can be finally deleted at this moment.
> >        */
> > -     if (!(inode->i_state & I_DIRTY_ALL))
> > -             inode_cgwb_move_to_attached(inode, wb);
> > -     else if (!(inode->i_state & I_SYNC_QUEUED)) {
> > -             if ((inode->i_state & I_DIRTY))
> > -                     redirty_tail_locked(inode, wb);
> > -             else if (inode->i_state & I_DIRTY_TIME) {
> > -                     inode->dirtied_when = jiffies;
> > -                     inode_io_list_move_locked(inode, wb, &wb->b_dirty_time);
> > +     if (!(inode->i_state & I_FREEING)) {
> > +             /*
> > +              * If the inode is now fully clean, then it can be safely
> > +              * removed from its writeback list (if any). Otherwise the
> > +              * flusher threads are responsible for the writeback lists.
> > +              */
> > +             if (!(inode->i_state & I_DIRTY_ALL))
> > +                     inode_cgwb_move_to_attached(inode, wb);
> > +             else if (!(inode->i_state & I_SYNC_QUEUED)) {
> > +                     if ((inode->i_state & I_DIRTY))
> > +                             redirty_tail_locked(inode, wb);
> > +                     else if (inode->i_state & I_DIRTY_TIME) {
> > +                             inode->dirtied_when = jiffies;
> > +                             inode_io_list_move_locked(inode,
> > +                                                       wb,
> > +                                                       &wb->b_dirty_time);
> > +                     }
> >               }
> >       }
> >
> > --
> > 2.38.1.431.g37b22c650d-goog
> >
> --
> Jan Kara <jack@...e.com>
> SUSE Labs, CR

--
Slava