Messages in this thread Patch in this message | | | Date | Thu, 24 Nov 2022 13:45:18 +0100 | From | Miklos Szeredi <> | Subject | Re: [PATCH] ovl: Fix use inode directly in rcu-walk mode |
| |
On Thu, Nov 24, 2022 at 05:26:02PM +0800, Chen Zhongjin wrote: > syzkaller reported a null-ptr-deref error: > https://syzkaller.appspot.com/bug?id=bb281e89381b9ed55728c274447a575e69a96c35 > > ovl_dentry_revalidate_common() can be called in rcu-walk mode. > As document said, "in rcu-walk mode, d_parent and d_inode should not be > used without care". Check inode here to protect access under rcu-walk > mode. > > Fixes: bccece1ead36 ("ovl: allow remote upper") > Reported-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com > Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Hi,
Thanks for the quick analysis and patch.
I simplified the patch a bit without changing the attribution.
Thanks, Miklos
---- From: Chen Zhongjin <chenzhongjin@huawei.com> Subject: ovl: fix use inode directly in rcu-walk mode
ovl_dentry_revalidate_common() can be called in rcu-walk mode. As document said, "in rcu-walk mode, d_parent and d_inode should not be used without care".
Check inode here to protect access under rcu-walk mode.
Fixes: bccece1ead36 ("ovl: allow remote upper") Reported-by: syzbot+a4055c78774bbf3498bb@syzkaller.appspotmail.com Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Cc: <stable@vger.kernel.org> # v5.7 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> --- fs/overlayfs/super.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -139,11 +139,16 @@ static int ovl_dentry_revalidate_common( unsigned int flags, bool weak) { struct ovl_entry *oe = dentry->d_fsdata; + struct inode *inode = d_inode_rcu(dentry); struct dentry *upper; unsigned int i; int ret = 1; - upper = ovl_dentry_upper(dentry); + /* Careful in RCU mode */ + if (!inode) + return -ECHILD; + + upper = ovl_i_dentry_upper(inode); if (upper) ret = ovl_revalidate_real(upper, flags, weak);
| |