From patchwork Mon Oct 24 11:29:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 8706 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp422953wru; Mon, 24 Oct 2022 05:23:43 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6XRXVuNvXEnLMdZz44ic2JS3Hqvd1DTOch9h9oNrUWv1wQqtt1gSC66VgPosae7Lwf7bk2 X-Received: by 2002:a17:907:a425:b0:78d:b3ce:1e43 with SMTP id sg37-20020a170907a42500b0078db3ce1e43mr26948263ejc.95.1666614222763; Mon, 24 Oct 2022 05:23:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666614222; cv=none; d=google.com; s=arc-20160816; b=fqeVVDISxq0kYy/HOMs6EbWHXDexhK6+kI3tMnHucPX4WdW555j0nx17iPIKPGvZx8 QFOmYKZsE1eIQOITgBJRo+283Wxv38noT727JV8xrTyiboDS4me7HYcOqMzU+uGRcKyj pAebIsFtYav7HKnYvOgeLwD4xWpogLYzgdL4CGcMqSU+FRIPFndUaOwHo9VvOm5imJcX KCK2t8ValiFwBgtEpaX98mYgqSQ2fo+vPw3m99wl/eJs2TwpCvG6KFIwjlreZ5RznsML naQYpiRpaIsxEtaZeg8+GFRp1xSM99Jat4rQt1GGiUOQqt/ivp6b7YNeMMc1o3tCGmpd frtw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=wiBsbzYX83WP9AE5nSjuz6/q7OEivkPR/55sQvr2Jw8=; b=E8149qtsCJ3jISKdxwHjxikOxCXxoq1HaYBorrDErEnB+M54ml2Eduqg7laxrowPBw 7KKGaC7iXvekucIyk5J52croIW4a6SCzOM6B0wVhNuLLxlDY8kYMxw4wr1kLKuO4Hpon pxzYG8MjYfsQS2+uXrLwTsh9i+gs2BnjwOG3Fp76AGDHkHRaQyCfNvOElQMpwUMHLttj EglEXGk8CLHoZ+9Efhnkf14By7NpIUhCFw7bYWtiqoa0uUS2FNwmipGxmLzLEqmaS0r1 ERtDcGH9TtFARfj/+Voe60i3oUIGFr1THOw/C+bjqqbCi216g6effIvAEYgYuYdQm8K3 0pBA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=AvNa7M+4; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id u8-20020a056402064800b00458cdba7a90si23441521edx.471.2022.10.24.05.23.19; Mon, 24 Oct 2022 05:23:42 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=AvNa7M+4; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233500AbiJXMWc (ORCPT + 99 others); Mon, 24 Oct 2022 08:22:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40714 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233608AbiJXMT4 (ORCPT ); Mon, 24 Oct 2022 08:19:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3D2B583234; Mon, 24 Oct 2022 04:58:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CE1746128E; Mon, 24 Oct 2022 11:49:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E2775C433C1; Mon, 24 Oct 2022 11:49:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666612197; bh=62cxHPxacIeJObyCUvpGDXSutCGffzA9SR9xi6Ab0Pw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AvNa7M+45r94/B8gJ/AJk2db0EjEySjTY59BaWfkC4mp2RQRguRq62IMwPNK4vp9y jJogRK6fM4+myxMEPMv+ilR7+AmFAz5tPbgwJ6OhLKeNAtNgzRm3NpfCD7smdef85D wBawKM+P6fCocKAACk24ieBXWG2u7b8o9SGs54lw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ryusuke Konishi , syzbot+b8c672b0e22615c80fe0@syzkaller.appspotmail.com, Khalid Masum , Andrew Morton Subject: [PATCH 4.14 065/210] nilfs2: fix use-after-free bug of struct nilfs_root Date: Mon, 24 Oct 2022 13:29:42 +0200 Message-Id: <20221024112959.153644357@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221024112956.797777597@linuxfoundation.org> References: <20221024112956.797777597@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747571674814943208?= X-GMAIL-MSGID: =?utf-8?q?1747571674814943208?= From: Ryusuke Konishi commit d325dc6eb763c10f591c239550b8c7e5466a5d09 upstream. If the beginning of the inode bitmap area is corrupted on disk, an inode with the same inode number as the root inode can be allocated and fail soon after. In this case, the subsequent call to nilfs_clear_inode() on that bogus root inode will wrongly decrement the reference counter of struct nilfs_root, and this will erroneously free struct nilfs_root, causing kernel oopses. This fixes the problem by changing nilfs_new_inode() to skip reserved inode numbers while repairing the inode bitmap. Link: https://lkml.kernel.org/r/20221003150519.39789-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+b8c672b0e22615c80fe0@syzkaller.appspotmail.com Reported-by: Khalid Masum Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- fs/nilfs2/inode.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -344,6 +344,7 @@ struct inode *nilfs_new_inode(struct ino struct inode *inode; struct nilfs_inode_info *ii; struct nilfs_root *root; + struct buffer_head *bh; int err = -ENOMEM; ino_t ino; @@ -359,11 +360,26 @@ struct inode *nilfs_new_inode(struct ino ii->i_state = BIT(NILFS_I_NEW); ii->i_root = root; - err = nilfs_ifile_create_inode(root->ifile, &ino, &ii->i_bh); + err = nilfs_ifile_create_inode(root->ifile, &ino, &bh); if (unlikely(err)) goto failed_ifile_create_inode; /* reference count of i_bh inherits from nilfs_mdt_read_block() */ + if (unlikely(ino < NILFS_USER_INO)) { + nilfs_msg(sb, KERN_WARNING, + "inode bitmap is inconsistent for reserved inodes"); + do { + brelse(bh); + err = nilfs_ifile_create_inode(root->ifile, &ino, &bh); + if (unlikely(err)) + goto failed_ifile_create_inode; + } while (ino < NILFS_USER_INO); + + nilfs_msg(sb, KERN_INFO, + "repaired inode bitmap for reserved inodes"); + } + ii->i_bh = bh; + atomic64_inc(&root->inodes_count); inode_init_owner(inode, dir, mode); inode->i_ino = ino;