Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-16 01:54:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fsnotify: Fix ordering of iput() and watched_objects decrement

Browse Source 
Ensure the superblock is kept alive until we're done with iput().
Holding a reference to an inode is not allowed unless we ensure the
superblock stays alive, which fsnotify does by keeping the
watched_objects count elevated, so iput() must happen before the
watched_objects decrement.
This can lead to a UAF of something like sb->s_fs_info in tmpfs, but the
UAF is hard to hit because race orderings that oops are more likely, thanks
to the CHECK_DATA_CORRUPTION() block in generic_shutdown_super().

Also, ensure that fsnotify_put_sb_watched_objects() doesn't call
fsnotify_sb_watched_objects() on a superblock that may have already been
freed, which would cause a UAF read of sb->s_fsnotify_info.

Cc: stable@kernel.org
Fixes: d2f277e26f52 ("fsnotify: rename fsnotify_{get,put}_sb_connectors()")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jan Kara <jack@suse.cz>
This commit is contained in:
Jann Horn 2024-11-18 17:33:13 +01:00 committed by Jan Kara
parent aa52c54da4
commit 21d1b618b6
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
fs/notify/mark.c
View File

@ -138,8 +138,11 @@ static void fsnotify_get_sb_watched_objects(struct super_block *sb)
static void fsnotify_put_sb_watched_objects(struct super_block *sb)
{
if (atomic_long_dec_and_test(fsnotify_sb_watched_objects(sb)))
wake_up_var(fsnotify_sb_watched_objects(sb));
atomic_long_t *watched_objects = fsnotify_sb_watched_objects(sb);
/* the superblock can go away after this decrement */
if (atomic_long_dec_and_test(watched_objects))
wake_up_var(watched_objects);
}
static void fsnotify_get_inode_ref(struct inode *inode)
@ -150,8 +153,11 @@ static void fsnotify_get_inode_ref(struct inode *inode)
static void fsnotify_put_inode_ref(struct inode *inode)
{
fsnotify_put_sb_watched_objects(inode->i_sb);
/* read ->i_sb before the inode can go away */
struct super_block *sb = inode->i_sb;
iput(inode);
fsnotify_put_sb_watched_objects(sb);
}
/*