Message ID | 20221013175146.577263099@linuxfoundation.org |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp412456wrs; Thu, 13 Oct 2022 11:10:43 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4hXz2QEINk5csKrwzEw6z6YcYoBuSFR8vrK+gVNcNJgNC5Ds4xazdhFPkF6OOihBy7uJe8 X-Received: by 2002:a62:1a97:0:b0:562:5587:12d6 with SMTP id a145-20020a621a97000000b00562558712d6mr917511pfa.37.1665684643592; Thu, 13 Oct 2022 11:10:43 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1665684643; cv=none; d=google.com; s=arc-20160816; b=zM9CBkZNEi4n/4X0HYV6t9Gj/PDIEjIPqC7P/muDu5grOOMUwfEq3QoFJjgEeNxhmT ID09/F87upJecd2ufVRHvhCm6GACoQXjg5ayacDcdW18sjPnVseGuObs8WYPe88Rf92q aolhBDPE9gbSZjf6K4PMbEOUxY7TygqAXC3pXEH5RGFFfQY67otFMVL+WWytDNmLmd6G ZbxOtz8/eh75VAjcfj3WKziTUtXfV0BY83R1E4tt8tWE10knPam4Qo3dhknIiUaaNAdw Dz5RryypkrTk+PNcrcUoWJ2Kjc6D5DgQ1ya7AmC2CHjAps6f2jd12wl5AbRmgOkXYO6u PWkg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=R5Ts1gYK+bv7sl4la9+VHGihDX7toXEO/CyqXOirrDE=; b=MkuXsRZvdahXhpcSmZhe0KCcFVj0CN7WjpOgYPHxqr00Z1HmWMAeSo1t8MzS4dExuu pKbfZZdxQG6Jk4hv4Iy0ZoULBSdKf9wcSw9D0JAIw5liBR57fTEv8Q3PAskHZ9I4j7Y0 PDXnwQYIepRjdOVxgY0SzOQQpMm8YrhPJ/2C1A/vJbqL+kXjmXJh2PQU0owmcZSmVHXa TN2nnstTjNIPgyewQo+Ahxbp/kD4uKcMGyBDf+QKa7T9k/lcm8Ov/L0hvzJp7AyPJXfN 2AkJGLKvC27y4uwYWb70vGMQ+udrJhMCyQSR2joM9dN2fQilw9tk1Sh3UHhhJFe2kRBb 85yg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=FV1OdCaJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id y192-20020a638ac9000000b0043ca0a1f7dasi24464pgd.674.2022.10.13.11.10.31; Thu, 13 Oct 2022 11:10:43 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=FV1OdCaJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230395AbiJMSKW (ORCPT <rfc822;ouuuleilei@gmail.com> + 99 others); Thu, 13 Oct 2022 14:10:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57624 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231376AbiJMSJr (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Thu, 13 Oct 2022 14:09:47 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D34CB169CC5; Thu, 13 Oct 2022 11:07:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3D8E061A36; Thu, 13 Oct 2022 18:01:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 46503C433C1; Thu, 13 Oct 2022 18:01:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665684084; bh=7lrOG+XELFk1IIcIKmG8btdaYc1FlQlU2Ev0FtNv+Y0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FV1OdCaJHWxchlec9bXrwfbcjaOK8uA4fSUmJCJPoCB/ghSDsUwu8L76EL1S81ppy ifag9ImHq3rGBoSbnAWrzCuxxDjVLiRiAW9TsVIJzYNRxDRnP+otvgkvTfmNlqEMW8 CDeOH19VCEXi8eEq5wK/DskryfFECndEeuLnwdEQ= From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Ryusuke Konishi <konishi.ryusuke@gmail.com>, syzbot+b8c672b0e22615c80fe0@syzkaller.appspotmail.com, Khalid Masum <khalid.masum.92@gmail.com>, Andrew Morton <akpm@linux-foundation.org> Subject: [PATCH 6.0 02/34] nilfs2: fix use-after-free bug of struct nilfs_root Date: Thu, 13 Oct 2022 19:52:40 +0200 Message-Id: <20221013175146.577263099@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221013175146.507746257@linuxfoundation.org> References: <20221013175146.507746257@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746596941085759655?= X-GMAIL-MSGID: =?utf-8?q?1746596941085759655?= |
Series |
None
|
|
Commit Message
Greg KH
Oct. 13, 2022, 5:52 p.m. UTC
From: Ryusuke Konishi <konishi.ryusuke@gmail.com> commit d325dc6eb763c10f591c239550b8c7e5466a5d09 upstream. If the beginning of the inode bitmap area is corrupted on disk, an inode with the same inode number as the root inode can be allocated and fail soon after. In this case, the subsequent call to nilfs_clear_inode() on that bogus root inode will wrongly decrement the reference counter of struct nilfs_root, and this will erroneously free struct nilfs_root, causing kernel oopses. This fixes the problem by changing nilfs_new_inode() to skip reserved inode numbers while repairing the inode bitmap. Link: https://lkml.kernel.org/r/20221003150519.39789-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Reported-by: syzbot+b8c672b0e22615c80fe0@syzkaller.appspotmail.com Reported-by: Khalid Masum <khalid.masum.92@gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- fs/nilfs2/inode.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
--- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -328,6 +328,7 @@ struct inode *nilfs_new_inode(struct ino struct inode *inode; struct nilfs_inode_info *ii; struct nilfs_root *root; + struct buffer_head *bh; int err = -ENOMEM; ino_t ino; @@ -343,11 +344,25 @@ struct inode *nilfs_new_inode(struct ino ii->i_state = BIT(NILFS_I_NEW); ii->i_root = root; - err = nilfs_ifile_create_inode(root->ifile, &ino, &ii->i_bh); + err = nilfs_ifile_create_inode(root->ifile, &ino, &bh); if (unlikely(err)) goto failed_ifile_create_inode; /* reference count of i_bh inherits from nilfs_mdt_read_block() */ + if (unlikely(ino < NILFS_USER_INO)) { + nilfs_warn(sb, + "inode bitmap is inconsistent for reserved inodes"); + do { + brelse(bh); + err = nilfs_ifile_create_inode(root->ifile, &ino, &bh); + if (unlikely(err)) + goto failed_ifile_create_inode; + } while (ino < NILFS_USER_INO); + + nilfs_info(sb, "repaired inode bitmap for reserved inodes"); + } + ii->i_bh = bh; + atomic64_inc(&root->inodes_count); inode_init_owner(&init_user_ns, inode, dir, mode); inode->i_ino = ino;