linux-kernel - Re: [PATCH] ovl: Fix use inode directly in rcu-walk mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6651f11c-9c56-6988-2e43-c6890fa51751@huawei.com>
Date:   Thu, 24 Nov 2022 21:18:00 +0800
From:   Chen Zhongjin <chenzhongjin@...wei.com>
To:     Miklos Szeredi <miklos@...redi.hu>
CC:     <syzbot+a4055c78774bbf3498bb@...kaller.appspotmail.com>,
        <linux-unionfs@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] ovl: Fix use inode directly in rcu-walk mode

On 2022/11/24 20:45, Miklos Szeredi wrote:
> On Thu, Nov 24, 2022 at 05:26:02PM +0800, Chen Zhongjin wrote:
>> syzkaller reported a null-ptr-deref error:
>> https://syzkaller.appspot.com/bug?id=bb281e89381b9ed55728c274447a575e69a96c35
>>
>> ovl_dentry_revalidate_common() can be called in rcu-walk mode.
>> As document said, "in rcu-walk mode, d_parent and d_inode should not be
>> used without care". Check inode here to protect access under rcu-walk
>> mode.
>>
>> Fixes: bccece1ead36 ("ovl: allow remote upper")
>> Reported-by: syzbot+a4055c78774bbf3498bb@...kaller.appspotmail.com
>> Signed-off-by: Chen Zhongjin <chenzhongjin@...wei.com>
> Hi,
>
> Thanks for the quick analysis and patch.
>
> I simplified the patch a bit without changing the attribution.
>
> Thanks,
> Miklos
>
> ----
> From: Chen Zhongjin <chenzhongjin@...wei.com>
> Subject: ovl: fix use inode directly in rcu-walk mode
>
> ovl_dentry_revalidate_common() can be called in rcu-walk mode.  As document
> said, "in rcu-walk mode, d_parent and d_inode should not be used without
> care".
>
> Check inode here to protect access under rcu-walk mode.
>
> Fixes: bccece1ead36 ("ovl: allow remote upper")
> Reported-by: syzbot+a4055c78774bbf3498bb@...kaller.appspotmail.com
> Signed-off-by: Chen Zhongjin <chenzhongjin@...wei.com>
> Cc: <stable@...r.kernel.org> # v5.7
> Signed-off-by: Miklos Szeredi <mszeredi@...hat.com>
> ---
>   fs/overlayfs/super.c |    7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
>
> --- a/fs/overlayfs/super.c
> +++ b/fs/overlayfs/super.c
> @@ -139,11 +139,16 @@ static int ovl_dentry_revalidate_common(
>   					unsigned int flags, bool weak)
>   {
>   	struct ovl_entry *oe = dentry->d_fsdata;
> +	struct inode *inode = d_inode_rcu(dentry);
>   	struct dentry *upper;
>   	unsigned int i;
>   	int ret = 1;
>   
> -	upper = ovl_dentry_upper(dentry);
> +	/* Careful in RCU mode */
> +	if (!inode)
> +		return -ECHILD;
> +
> +	upper = ovl_i_dentry_upper(inode);
>   	if (upper)
>   		ret = ovl_revalidate_real(upper, flags, weak);
>   

Thanks for review! LGTM

Best,
Chen