[06/10] cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode
Message ID | 20240122123845.3822570-7-dhowells@redhat.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel+bounces-33035-ouuuleilei=gmail.com@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:2bc4:b0:101:a8e8:374 with SMTP id hx4csp2547824dyb; Mon, 22 Jan 2024 04:55:26 -0800 (PST) X-Google-Smtp-Source: AGHT+IFkdNV68me+7BklLNPg2Jfepp6uLNbJuAJYDZzVubcuXqU4yb/WN0CnlGgKBBiZt3V8eKLn X-Received: by 2002:a17:90a:db0a:b0:28f:fa54:eb30 with SMTP id g10-20020a17090adb0a00b0028ffa54eb30mr1242511pjv.37.1705928126512; Mon, 22 Jan 2024 04:55:26 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1705928126; cv=pass; d=google.com; s=arc-20160816; b=cMt5YwlVexKwhe7WZeSVgLENbMtBcDQ9Jl/axmiP+Cn8MshQTb21tGRyfZbCqOAGnS GgB10PR9zZxdnRAbOUZAn1GUM0jStHkd95XN92Ruhyuof06gkf+ltPQDs/i21jH5QS3V nBIjxMNNrQTfU7Hg55P8DpOVE5ps532wzN5CF0aSV9xkX20wVbigRXCo3hjjnEfLP0z8 R20VlLoYOjlFZlzYTsRCp6vcOf8os9rrpxBtZDHDyOAlyVWA+fosJDKZbo1VoBxrNgOb feLG8M7wuLF9gcEayLR1+OZkovRgnlpvLpEXYk4mv5/ATgmyM3QqiLqtnPXTrP28903Y 0JDg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:cc:to:from:dkim-signature; bh=iici4CcialH0lyfTdSLWnoYWTya5IEpmfmLuwHkca5Y=; fh=+2KVsuS3QQLhBtnZbdoLaJ8xs7SIeHL/Neowe1JxX6s=; b=u5I8PALS+gmwd+K/Y9ouBEAcP7ZP4Z5w8C/9nRtEflZNZnBisqfamVZ9wotyX0phkq CBVRcVVCSoyHA7nroSzNIwgpPIrXm3H7EJp09XnxLiWzJchJ/GF1z9K2Wu1ZnX9tBZ0n W74hGNb+tEoNTSgedflkzToJuY6XCP4r+oc1dITd5TLlXb6ZvFjyQm0EpLvJU/TCUCV7 /sOEO298b6xSoLLD90vdbYoo8mxb9kGoq+VW2xu5mhr0oGVnejmFb4M00Dg6h+kywfyU EvxyCBGMIdA387ULoKT3AM4btbEXGxNxVtS3U2KaQv1lSap9uDMWqsl7iIsxFDgkcnv5 yNpA== ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=PRicYh0+; arc=pass (i=1 spf=pass spfdomain=redhat.com dkim=pass dkdomain=redhat.com dmarc=pass fromdomain=redhat.com); spf=pass (google.com: domain of linux-kernel+bounces-33035-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-33035-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [139.178.88.99]) by mx.google.com with ESMTPS id ci7-20020a17090afc8700b002900b3297dcsi6611827pjb.69.2024.01.22.04.55.26 for <ouuuleilei@gmail.com> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Jan 2024 04:55:26 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-33035-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=PRicYh0+; arc=pass (i=1 spf=pass spfdomain=redhat.com dkim=pass dkdomain=redhat.com dmarc=pass fromdomain=redhat.com); spf=pass (google.com: domain of linux-kernel+bounces-33035-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-33035-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 3BA3B29587C for <ouuuleilei@gmail.com>; Mon, 22 Jan 2024 12:43:30 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 30A333EA87; Mon, 22 Jan 2024 12:39:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="PRicYh0+" Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1886B3D55B for <linux-kernel@vger.kernel.org>; Mon, 22 Jan 2024 12:39:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1705927156; cv=none; b=SPZ8U4DwrfYl1alFCLO1+UK7nObHJjU3rfGO1nHcrAlRk/4VjRcrJ4sljllgtT0odvTSQFH992Evwnz/ethwk7wxHzBkf4r9jRQrcN04HLbS4a26JNF30IycytH+nuyRKBR3CkZP/W9klP5GxdrILk+SbkZj491qRdM5iz6Yq7g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1705927156; c=relaxed/simple; bh=8G3yBj9g+dso7iEfMFsKAhuhaGEPop9JL1MTx/cr1WY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nVsnXtSVYJ7vY+oN8vZJQOFNkw1Jf7mZaN4bL4Bj6Rw9jAGNrFn62h+uF+D0aeib6M7UogVp8+LkC3BjhrYSCAavlcjy94ovSRfS06Fcvr5A2R+VbiYEZZmR17tIjsTY588vl+dXbMaEq6kLGWicB3WN0QU3ErdcQNomdEY9Bmo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=PRicYh0+; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1705927154; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=iici4CcialH0lyfTdSLWnoYWTya5IEpmfmLuwHkca5Y=; b=PRicYh0+50QF1RLrVYruh1rfj7UfOCrh3emwtFgwytmwQ9p3XAS0Ub4Q0fMFwFJvbsIPeF BO4ms2gY6JzVfeb0cCGezOm8RLaJaQkxlUEFxzh2+afXWFl9W85MFMu1dPBZjmzvCadhCi xOJP9ogXHf/JUA+eLco9bhfhEImTIV8= Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-304-nqfuXrHZNCS78rn85yiyNQ-1; Mon, 22 Jan 2024 07:39:09 -0500 X-MC-Unique: nqfuXrHZNCS78rn85yiyNQ-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 0A9D51C05ABA; Mon, 22 Jan 2024 12:39:08 +0000 (UTC) Received: from warthog.procyon.org.com (unknown [10.42.28.67]) by smtp.corp.redhat.com (Postfix) with ESMTP id 9CA3E2026D66; Mon, 22 Jan 2024 12:39:05 +0000 (UTC) From: David Howells <dhowells@redhat.com> To: Christian Brauner <christian@brauner.io> Cc: David Howells <dhowells@redhat.com>, Jeff Layton <jlayton@kernel.org>, Matthew Wilcox <willy@infradead.org>, netfs@lists.linux.dev, linux-afs@lists.infradead.org, linux-cifs@vger.kernel.org, linux-nfs@vger.kernel.org, ceph-devel@vger.kernel.org, v9fs@lists.linux.dev, linux-erofs@lists.ozlabs.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Marc Dionne <marc.dionne@auristor.com>, Gao Xiang <xiang@kernel.org>, Chao Yu <chao@kernel.org>, Yue Hu <huyue2@coolpad.com>, Jeffle Xu <jefflexu@linux.alibaba.com> Subject: [PATCH 06/10] cachefiles, erofs: Fix NULL deref in when cachefiles is not doing ondemand-mode Date: Mon, 22 Jan 2024 12:38:39 +0000 Message-ID: <20240122123845.3822570-7-dhowells@redhat.com> In-Reply-To: <20240122123845.3822570-1-dhowells@redhat.com> References: <20240122123845.3822570-1-dhowells@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: <linux-kernel.vger.kernel.org> List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org> List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.4 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1788795291345821372 X-GMAIL-MSGID: 1788795291345821372 |
Series |
netfs, afs, cifs, cachefiles, erofs: Miscellaneous fixes
|
|
Commit Message
David Howells
Jan. 22, 2024, 12:38 p.m. UTC
cachefiles_ondemand_init_object() as called from cachefiles_open_file() and
cachefiles_create_tmpfile() does not check if object->ondemand is set
before dereferencing it, leading to an oops something like:
RIP: 0010:cachefiles_ondemand_init_object+0x9/0x41
...
Call Trace:
<TASK>
cachefiles_open_file+0xc9/0x187
cachefiles_lookup_cookie+0x122/0x2be
fscache_cookie_state_machine+0xbe/0x32b
fscache_cookie_worker+0x1f/0x2d
process_one_work+0x136/0x208
process_scheduled_works+0x3a/0x41
worker_thread+0x1a2/0x1f6
kthread+0xca/0xd2
ret_from_fork+0x21/0x33
Fix this by making the calls to cachefiles_ondemand_init_object()
conditional.
Fixes: 3c5ecfe16e76 ("cachefiles: extract ondemand info field from cachefiles_object")
Reported-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Gao Xiang <xiang@kernel.org>
cc: Chao Yu <chao@kernel.org>
cc: Yue Hu <huyue2@coolpad.com>
cc: Jeffle Xu <jefflexu@linux.alibaba.com>
cc: linux-erofs@lists.ozlabs.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
---
fs/cachefiles/namei.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
Comments
On 1/22/24 8:38 PM, David Howells wrote: > cachefiles_ondemand_init_object() as called from cachefiles_open_file() and > cachefiles_create_tmpfile() does not check if object->ondemand is set > before dereferencing it, leading to an oops something like: > > RIP: 0010:cachefiles_ondemand_init_object+0x9/0x41 > ... > Call Trace: > <TASK> > cachefiles_open_file+0xc9/0x187 > cachefiles_lookup_cookie+0x122/0x2be > fscache_cookie_state_machine+0xbe/0x32b > fscache_cookie_worker+0x1f/0x2d > process_one_work+0x136/0x208 > process_scheduled_works+0x3a/0x41 > worker_thread+0x1a2/0x1f6 > kthread+0xca/0xd2 > ret_from_fork+0x21/0x33 > > Fix this by making the calls to cachefiles_ondemand_init_object() > conditional. > > Fixes: 3c5ecfe16e76 ("cachefiles: extract ondemand info field from cachefiles_object") > Reported-by: Marc Dionne <marc.dionne@auristor.com> > Signed-off-by: David Howells <dhowells@redhat.com> > cc: Gao Xiang <xiang@kernel.org> > cc: Chao Yu <chao@kernel.org> > cc: Yue Hu <huyue2@coolpad.com> > cc: Jeffle Xu <jefflexu@linux.alibaba.com> > cc: linux-erofs@lists.ozlabs.org > cc: netfs@lists.linux.dev > cc: linux-fsdevel@vger.kernel.org > --- > fs/cachefiles/namei.c | 16 ++++++++++------ > 1 file changed, 10 insertions(+), 6 deletions(-) > > diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c > index 7ade836beb58..180594d24c44 100644 > --- a/fs/cachefiles/namei.c > +++ b/fs/cachefiles/namei.c > @@ -473,9 +473,11 @@ struct file *cachefiles_create_tmpfile(struct cachefiles_object *object) > if (!cachefiles_mark_inode_in_use(object, file_inode(file))) > WARN_ON(1); > > - ret = cachefiles_ondemand_init_object(object); > - if (ret < 0) > - goto err_unuse; > + if (object->ondemand) { > + ret = cachefiles_ondemand_init_object(object); > + if (ret < 0) > + goto err_unuse; > + } I'm not sure if object->ondemand shall be checked by the caller or inside cachefiles_ondemand_init_object(), as cachefiles_ondemand_clean_object() is also called without checking object->ondemand. cachefiles_ondemand_clean_object() won't trigger the NULL oops as the called cachefiles_ondemand_send_req() will actually checks that. Anyway this patch looks good to me. Thanks. Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com> > > ni_size = object->cookie->object_size; > ni_size = round_up(ni_size, CACHEFILES_DIO_BLOCK_SIZE); > @@ -579,9 +581,11 @@ static bool cachefiles_open_file(struct cachefiles_object *object, > } > _debug("file -> %pd positive", dentry); > > - ret = cachefiles_ondemand_init_object(object); > - if (ret < 0) > - goto error_fput; > + if (object->ondemand) { > + ret = cachefiles_ondemand_init_object(object); > + if (ret < 0) > + goto error_fput; > + } > > ret = cachefiles_check_auxdata(object, file); > if (ret < 0)
On 2024/1/22 20:38, David Howells wrote: > cachefiles_ondemand_init_object() as called from cachefiles_open_file() and > cachefiles_create_tmpfile() does not check if object->ondemand is set > before dereferencing it, leading to an oops something like: > > RIP: 0010:cachefiles_ondemand_init_object+0x9/0x41 > ... > Call Trace: > <TASK> > cachefiles_open_file+0xc9/0x187 > cachefiles_lookup_cookie+0x122/0x2be > fscache_cookie_state_machine+0xbe/0x32b > fscache_cookie_worker+0x1f/0x2d > process_one_work+0x136/0x208 > process_scheduled_works+0x3a/0x41 > worker_thread+0x1a2/0x1f6 > kthread+0xca/0xd2 > ret_from_fork+0x21/0x33 > > Fix this by making the calls to cachefiles_ondemand_init_object() > conditional. > > Fixes: 3c5ecfe16e76 ("cachefiles: extract ondemand info field from cachefiles_object") > Reported-by: Marc Dionne <marc.dionne@auristor.com> > Signed-off-by: David Howells <dhowells@redhat.com> > cc: Gao Xiang <xiang@kernel.org> > cc: Chao Yu <chao@kernel.org> > cc: Yue Hu <huyue2@coolpad.com> > cc: Jeffle Xu <jefflexu@linux.alibaba.com> > cc: linux-erofs@lists.ozlabs.org > cc: netfs@lists.linux.dev > cc: linux-fsdevel@vger.kernel.org Looks good to me, thanks for fixing this: Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com> Thanks, Gao Xiang
Jingbo Xu <jefflexu@linux.alibaba.com> wrote: > > - ret = cachefiles_ondemand_init_object(object); > > - if (ret < 0) > > - goto err_unuse; > > + if (object->ondemand) { > > + ret = cachefiles_ondemand_init_object(object); > > + if (ret < 0) > > + goto err_unuse; > > + } > > I'm not sure if object->ondemand shall be checked by the caller or > inside cachefiles_ondemand_init_object(), as > cachefiles_ondemand_clean_object() is also called without checking > object->ondemand. cachefiles_ondemand_clean_object() won't trigger the > NULL oops as the called cachefiles_ondemand_send_req() will actually > checks that. Meh. The above doesn't actually build if CONFIG_CACHEFILES_ONDEMAND=N. I think I have to push the check down into cachefiles_ondemand_init_object() instead. David
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c index 7ade836beb58..180594d24c44 100644 --- a/fs/cachefiles/namei.c +++ b/fs/cachefiles/namei.c @@ -473,9 +473,11 @@ struct file *cachefiles_create_tmpfile(struct cachefiles_object *object) if (!cachefiles_mark_inode_in_use(object, file_inode(file))) WARN_ON(1); - ret = cachefiles_ondemand_init_object(object); - if (ret < 0) - goto err_unuse; + if (object->ondemand) { + ret = cachefiles_ondemand_init_object(object); + if (ret < 0) + goto err_unuse; + } ni_size = object->cookie->object_size; ni_size = round_up(ni_size, CACHEFILES_DIO_BLOCK_SIZE); @@ -579,9 +581,11 @@ static bool cachefiles_open_file(struct cachefiles_object *object, } _debug("file -> %pd positive", dentry); - ret = cachefiles_ondemand_init_object(object); - if (ret < 0) - goto error_fput; + if (object->ondemand) { + ret = cachefiles_ondemand_init_object(object); + if (ret < 0) + goto error_fput; + } ret = cachefiles_check_auxdata(object, file); if (ret < 0)