mirror of
https://github.com/torvalds/linux.git
synced 2024-11-10 22:21:40 +00:00
c898afdc15
Fix a use-after-free on dentry's d_fsdata fid list when a thread
looks up a fid through dentry while another thread unlinks it:
UAF thread:
refcount_t: addition on 0; use-after-free.
p9_fid_get linux/./include/net/9p/client.h:262
v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129
v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181
v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314
v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400
vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248
Freed by:
p9_fid_destroy (inlined)
p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456
p9_fid_put linux/./include/net/9p/client.h:278
v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55
v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518
vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335
The problem is that d_fsdata was not accessed under d_lock, because
d_release() normally is only called once the dentry is otherwise no
longer accessible but since we also call it explicitly in v9fs_remove
that lock is required:
move the hlist out of the dentry under lock then unref its fids once
they are no longer accessible.
Fixes: 154372e67d ("fs/9p: fix create-unlink-getattr idiom")
Cc: stable@vger.kernel.org
Reported-by: Meysam Firouzi
Reported-by: Amirmohammad Eftekhar
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Message-ID: <20240521122947.1080227-1-asmadeus@codewreck.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
113 lines
2.5 KiB
C
113 lines
2.5 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* This file contians vfs dentry ops for the 9P2000 protocol.
|
|
*
|
|
* Copyright (C) 2004 by Eric Van Hensbergen <ericvh@gmail.com>
|
|
* Copyright (C) 2002 by Ron Minnich <rminnich@lanl.gov>
|
|
*/
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/errno.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/file.h>
|
|
#include <linux/pagemap.h>
|
|
#include <linux/stat.h>
|
|
#include <linux/string.h>
|
|
#include <linux/namei.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/slab.h>
|
|
#include <net/9p/9p.h>
|
|
#include <net/9p/client.h>
|
|
|
|
#include "v9fs.h"
|
|
#include "v9fs_vfs.h"
|
|
#include "fid.h"
|
|
|
|
/**
|
|
* v9fs_cached_dentry_delete - called when dentry refcount equals 0
|
|
* @dentry: dentry in question
|
|
*
|
|
*/
|
|
static int v9fs_cached_dentry_delete(const struct dentry *dentry)
|
|
{
|
|
p9_debug(P9_DEBUG_VFS, " dentry: %pd (%p)\n",
|
|
dentry, dentry);
|
|
|
|
/* Don't cache negative dentries */
|
|
if (d_really_is_negative(dentry))
|
|
return 1;
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* v9fs_dentry_release - called when dentry is going to be freed
|
|
* @dentry: dentry that is being release
|
|
*
|
|
*/
|
|
|
|
static void v9fs_dentry_release(struct dentry *dentry)
|
|
{
|
|
struct hlist_node *p, *n;
|
|
struct hlist_head head;
|
|
|
|
p9_debug(P9_DEBUG_VFS, " dentry: %pd (%p)\n",
|
|
dentry, dentry);
|
|
|
|
spin_lock(&dentry->d_lock);
|
|
hlist_move_list((struct hlist_head *)&dentry->d_fsdata, &head);
|
|
spin_unlock(&dentry->d_lock);
|
|
|
|
hlist_for_each_safe(p, n, &head)
|
|
p9_fid_put(hlist_entry(p, struct p9_fid, dlist));
|
|
}
|
|
|
|
static int v9fs_lookup_revalidate(struct dentry *dentry, unsigned int flags)
|
|
{
|
|
struct p9_fid *fid;
|
|
struct inode *inode;
|
|
struct v9fs_inode *v9inode;
|
|
|
|
if (flags & LOOKUP_RCU)
|
|
return -ECHILD;
|
|
|
|
inode = d_inode(dentry);
|
|
if (!inode)
|
|
goto out_valid;
|
|
|
|
v9inode = V9FS_I(inode);
|
|
if (v9inode->cache_validity & V9FS_INO_INVALID_ATTR) {
|
|
int retval;
|
|
struct v9fs_session_info *v9ses;
|
|
|
|
fid = v9fs_fid_lookup(dentry);
|
|
if (IS_ERR(fid))
|
|
return PTR_ERR(fid);
|
|
|
|
v9ses = v9fs_inode2v9ses(inode);
|
|
if (v9fs_proto_dotl(v9ses))
|
|
retval = v9fs_refresh_inode_dotl(fid, inode);
|
|
else
|
|
retval = v9fs_refresh_inode(fid, inode);
|
|
p9_fid_put(fid);
|
|
|
|
if (retval == -ENOENT)
|
|
return 0;
|
|
if (retval < 0)
|
|
return retval;
|
|
}
|
|
out_valid:
|
|
return 1;
|
|
}
|
|
|
|
const struct dentry_operations v9fs_cached_dentry_operations = {
|
|
.d_revalidate = v9fs_lookup_revalidate,
|
|
.d_weak_revalidate = v9fs_lookup_revalidate,
|
|
.d_delete = v9fs_cached_dentry_delete,
|
|
.d_release = v9fs_dentry_release,
|
|
};
|
|
|
|
const struct dentry_operations v9fs_dentry_operations = {
|
|
.d_delete = always_delete_dentry,
|
|
.d_release = v9fs_dentry_release,
|
|
};
|