From patchwork Thu Oct 13 17:52:34 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 2282 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp424935wrs; Thu, 13 Oct 2022 11:42:41 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6G9OlUTPsoqxVZ41185vYCFq2Mj93J8hA9KUvHUuMUrbHtebZgL3JqSeCt+TNKC68JUbXe X-Received: by 2002:a17:90b:4a90:b0:20d:5c5e:1622 with SMTP id lp16-20020a17090b4a9000b0020d5c5e1622mr12936704pjb.50.1665686560709; Thu, 13 Oct 2022 11:42:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1665686560; cv=none; d=google.com; s=arc-20160816; b=NGMGvOQOqoQ2vO7XoEXqG5fsyNXcHhOZh8h3vNUzHe0cHASRbBOwgu5u91UBXS4g1l vQ6Nc0JpE/JIM+vvbpKVG/HwJU/Z0/jrmFurGlgXtTyHvIvIM/m3pYyHkcHmq4cpLJVN 3Wi49zNFcqa/esICVwc1LOFLBFCusTZJY0cJD1rKfwq5Yh5RRn8y+SDsHQdThkAMFIu/ Uea2GO/GcXCmBZDCmNY9xGxGCjyzS2y8576Zf0Kiwv8KD04CxMXiv1Nr3J9PmNiYq0L1 6Wj9GT5m2hbzrjpddrifDjBC4dSZ9Oy6PKYxc2Ts0HTRsrauANQOJLEjNT8X6lBzL8dC YqhQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=R5Ts1gYK+bv7sl4la9+VHGihDX7toXEO/CyqXOirrDE=; b=lh8bFpnsfRoVAC77+aa5MIk2OzaaqSKas6yPcac+Qwv4jtteSpUVxOgkatVJahAzjt 2hQeQs3Cp/E13ygKuW1ms5qw4pv/q6Ub5l3Cy85tkgqP+RHgHdBx3A8dnWUIC8v+sfOe fPgcP50Xbx4Vp5kc1CVcsFd6oH6pLhoi3OsX5UcmKreSVXXy/aSDJjjAq78GjdgsSqHc yt2/Cp39oQXFwLtcAYvX5Ql4ySQMyt33ThLCGnUE3IL3UVhLsy7Dn8n7hv1wbKT56iIi SzazHIc7kUlQ3h7huSeQrOrJkjs/cyrSqz6vfVG+7Wx+iglAE2GUfonGd3kIX/42gLSA Yxfw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="B9f4HS7/"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t2-20020a17090a510200b00200a22064afsi5932350pjh.41.2022.10.13.11.42.28; Thu, 13 Oct 2022 11:42:40 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="B9f4HS7/"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231831AbiJMS2O (ORCPT + 99 others); Thu, 13 Oct 2022 14:28:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37312 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231924AbiJMS13 (ORCPT ); Thu, 13 Oct 2022 14:27:29 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A680918A3E2; Thu, 13 Oct 2022 11:22:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 85ED7B8204B; Thu, 13 Oct 2022 17:59:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E0074C433C1; Thu, 13 Oct 2022 17:59:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665683953; bh=7lrOG+XELFk1IIcIKmG8btdaYc1FlQlU2Ev0FtNv+Y0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=B9f4HS7/pHnV5P14uWo9RiBYMqIPArxCEOAEHFrJyEBGfTsta4J9aPvUnBhOQoaiG B4WjSDHl1UPyNByCgUEOL8pSEEMi5yvf9r4+YEAgQDcOPuEp9xVfD12TBjIJ3DZcx8 mCpxu290OzK4/eLGkys/lRnXOO72tgb53QAnVptU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ryusuke Konishi , syzbot+b8c672b0e22615c80fe0@syzkaller.appspotmail.com, Khalid Masum , Andrew Morton Subject: [PATCH 5.19 02/33] nilfs2: fix use-after-free bug of struct nilfs_root Date: Thu, 13 Oct 2022 19:52:34 +0200 Message-Id: <20221013175145.312497204@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221013175145.236739253@linuxfoundation.org> References: <20221013175145.236739253@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746598950869977150?= X-GMAIL-MSGID: =?utf-8?q?1746598950869977150?= From: Ryusuke Konishi commit d325dc6eb763c10f591c239550b8c7e5466a5d09 upstream. If the beginning of the inode bitmap area is corrupted on disk, an inode with the same inode number as the root inode can be allocated and fail soon after. In this case, the subsequent call to nilfs_clear_inode() on that bogus root inode will wrongly decrement the reference counter of struct nilfs_root, and this will erroneously free struct nilfs_root, causing kernel oopses. This fixes the problem by changing nilfs_new_inode() to skip reserved inode numbers while repairing the inode bitmap. Link: https://lkml.kernel.org/r/20221003150519.39789-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+b8c672b0e22615c80fe0@syzkaller.appspotmail.com Reported-by: Khalid Masum Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- fs/nilfs2/inode.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -328,6 +328,7 @@ struct inode *nilfs_new_inode(struct ino struct inode *inode; struct nilfs_inode_info *ii; struct nilfs_root *root; + struct buffer_head *bh; int err = -ENOMEM; ino_t ino; @@ -343,11 +344,25 @@ struct inode *nilfs_new_inode(struct ino ii->i_state = BIT(NILFS_I_NEW); ii->i_root = root; - err = nilfs_ifile_create_inode(root->ifile, &ino, &ii->i_bh); + err = nilfs_ifile_create_inode(root->ifile, &ino, &bh); if (unlikely(err)) goto failed_ifile_create_inode; /* reference count of i_bh inherits from nilfs_mdt_read_block() */ + if (unlikely(ino < NILFS_USER_INO)) { + nilfs_warn(sb, + "inode bitmap is inconsistent for reserved inodes"); + do { + brelse(bh); + err = nilfs_ifile_create_inode(root->ifile, &ino, &bh); + if (unlikely(err)) + goto failed_ifile_create_inode; + } while (ino < NILFS_USER_INO); + + nilfs_info(sb, "repaired inode bitmap for reserved inodes"); + } + ii->i_bh = bh; + atomic64_inc(&root->inodes_count); inode_init_owner(&init_user_ns, inode, dir, mode); inode->i_ino = ino;