Messages in this thread | | | Date | Thu, 24 Nov 2022 21:18:00 +0800 | Subject | Re: [PATCH] ovl: Fix use inode directly in rcu-walk mode | From | Chen Zhongjin <> |
| |
On 2022/11/24 20:45, Miklos Szeredi wrote: > On Thu, Nov 24, 2022 at 05:26:02PM +0800, Chen Zhongjin wrote: >> syzkaller reported a null-ptr-deref error: >> https://syzkaller.appspot.com/bug?id=bb281e89381b9ed55728c274447a575e69a96c35 >> >> ovl_dentry_revalidate_common() can be called in rcu-walk mode. >> As document said, "in rcu-walk mode, d_parent and d_inode should not be >> used without care". Check inode here to protect access under rcu-walk >> mode. >> >> Fixes: bccece1ead36 ("ovl: allow remote upper") >> Reported-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com >> Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> > Hi, > > Thanks for the quick analysis and patch. > > I simplified the patch a bit without changing the attribution. > > Thanks, > Miklos > > ---- > From: Chen Zhongjin <chenzhongjin@huawei.com> > Subject: ovl: fix use inode directly in rcu-walk mode > > ovl_dentry_revalidate_common() can be called in rcu-walk mode. As document > said, "in rcu-walk mode, d_parent and d_inode should not be used without > care". > > Check inode here to protect access under rcu-walk mode. > > Fixes: bccece1ead36 ("ovl: allow remote upper") > Reported-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com > Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> > Cc: <stable@vger.kernel.org> # v5.7 > Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> > --- > fs/overlayfs/super.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > --- a/fs/overlayfs/super.c > +++ b/fs/overlayfs/super.c > @@ -139,11 +139,16 @@ static int ovl_dentry_revalidate_common( > unsigned int flags, bool weak) > { > struct ovl_entry *oe = dentry->d_fsdata; > + struct inode *inode = d_inode_rcu(dentry); > struct dentry *upper; > unsigned int i; > int ret = 1; > > - upper = ovl_dentry_upper(dentry); > + /* Careful in RCU mode */ > + if (!inode) > + return -ECHILD; > + > + upper = ovl_i_dentry_upper(inode); > if (upper) > ret = ovl_revalidate_real(upper, flags, weak); >
Thanks for review! LGTM
Best, Chen
| |