From patchwork Thu Oct 13 17:51:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 2163 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp405931wrs; Thu, 13 Oct 2022 10:59:27 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4K0RzZhJKW40gCH+FMHYXgT7rNLnBceVJ6XQuFKFZ0M9ZZJOQX2NSS8HQaOiy4JlElwirV X-Received: by 2002:a17:907:2708:b0:78d:d22b:c8a9 with SMTP id w8-20020a170907270800b0078dd22bc8a9mr710438ejk.640.1665683967615; Thu, 13 Oct 2022 10:59:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1665683967; cv=none; d=google.com; s=arc-20160816; b=WB82WKIgKcJAeASDhWG+qoZNNGJvRC21hEpA7nwp9fekEekwPJGmYu1QJ8YIMFQKMT 4ielX9n5nZ+WgILfa1zogFrUM7NV+jj+pWwLhAeUanQw2wUUtMl2Y5OIK3r06reaqPCX j7axOpj9mKew2BseT/c2mAjnE5gekBExUclHry1ThWE7VNT46xQXV5+3el3LMqEQl6JT PyaixIgoapSUY4xK3g3NEsd9OMtiyB5ZCsb97MHJpVKfa+KxXgUSFwl5NmsKtXz4KoW0 j1+jzT3ITPdyzoeRsveNEFFUdn7pLSLG+tnUeFQ9Op75OCqkm/yWZQHnsURuAXnFcvG5 kvsg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=248yPeGJ4igLOkCb5vwNJU+vNzIPZ3VBe3mqQPKwvGc=; b=bnvd/E50DjlIw/WT6h2BccRcmP7Md44ZSihmt72FSHZblkTpCw+etHc4UQ6y6g2sWX SoIN4FblRCnpjchrUp8Fy1S4jPwO+yZ9hnd6rkmaIfWfycjaZZPXyNhMlBe4JE4Gnx/s M311yWVR7DJ9xZHaYr/nlyMf6g60BzT3xwTDJV76j9KNHshtH0rLzCSIpGAbAec9kR8z n8EZeWRQ6USN/vDzzw3NpQz9Lv/y4wtpexuoISRdpVjusnlvj9Prlhr5wuFd9HvZ809z JL4/qPFoR3UYtTcCgkIJcRy515FHLWy5+pWhcynwW37yis1I9sNretNdHYQdgd2xElDT T7Xw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=DNpjiB8n; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id y18-20020aa7ce92000000b00442296a8407si223047edv.629.2022.10.13.10.58.49; Thu, 13 Oct 2022 10:59:27 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=DNpjiB8n; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230213AbiJMR6T (ORCPT + 99 others); Thu, 13 Oct 2022 13:58:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54738 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230157AbiJMR5Z (ORCPT ); Thu, 13 Oct 2022 13:57:25 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5B8A467C97; Thu, 13 Oct 2022 10:56:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 06B31618FB; Thu, 13 Oct 2022 17:54:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 15D5FC433D6; Thu, 13 Oct 2022 17:54:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665683681; bh=jk4n9BSYyxD6hRGgHsVIYR6ysfCma4ji0iOCcXKE4z8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DNpjiB8ngGDhbGNeH94DKYe0Pe6QZTaUPGWNpdEBnvKDAO72qUdHXRmJG67gZ42pg BxGH2SnksOuhiCR3+f83RanBInrME64ZjxJWaZjv28QJlKYSR9StCRwfinhmrzVZlv c3LoPx/97sSCP7FwM3oUqHomSbGGJBtDwmdm87D0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ryusuke Konishi , syzbot+b8c672b0e22615c80fe0@syzkaller.appspotmail.com, Khalid Masum , Andrew Morton Subject: [PATCH 5.10 02/54] nilfs2: fix use-after-free bug of struct nilfs_root Date: Thu, 13 Oct 2022 19:51:56 +0200 Message-Id: <20221013175147.403694752@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221013175147.337501757@linuxfoundation.org> References: <20221013175147.337501757@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1746596232155619846?= X-GMAIL-MSGID: =?utf-8?q?1746596232155619846?= From: Ryusuke Konishi commit d325dc6eb763c10f591c239550b8c7e5466a5d09 upstream. If the beginning of the inode bitmap area is corrupted on disk, an inode with the same inode number as the root inode can be allocated and fail soon after. In this case, the subsequent call to nilfs_clear_inode() on that bogus root inode will wrongly decrement the reference counter of struct nilfs_root, and this will erroneously free struct nilfs_root, causing kernel oopses. This fixes the problem by changing nilfs_new_inode() to skip reserved inode numbers while repairing the inode bitmap. Link: https://lkml.kernel.org/r/20221003150519.39789-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+b8c672b0e22615c80fe0@syzkaller.appspotmail.com Reported-by: Khalid Masum Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- fs/nilfs2/inode.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -332,6 +332,7 @@ struct inode *nilfs_new_inode(struct ino struct inode *inode; struct nilfs_inode_info *ii; struct nilfs_root *root; + struct buffer_head *bh; int err = -ENOMEM; ino_t ino; @@ -347,11 +348,25 @@ struct inode *nilfs_new_inode(struct ino ii->i_state = BIT(NILFS_I_NEW); ii->i_root = root; - err = nilfs_ifile_create_inode(root->ifile, &ino, &ii->i_bh); + err = nilfs_ifile_create_inode(root->ifile, &ino, &bh); if (unlikely(err)) goto failed_ifile_create_inode; /* reference count of i_bh inherits from nilfs_mdt_read_block() */ + if (unlikely(ino < NILFS_USER_INO)) { + nilfs_warn(sb, + "inode bitmap is inconsistent for reserved inodes"); + do { + brelse(bh); + err = nilfs_ifile_create_inode(root->ifile, &ino, &bh); + if (unlikely(err)) + goto failed_ifile_create_inode; + } while (ino < NILFS_USER_INO); + + nilfs_info(sb, "repaired inode bitmap for reserved inodes"); + } + ii->i_bh = bh; + atomic64_inc(&root->inodes_count); inode_init_owner(inode, dir, mode); inode->i_ino = ino;