fuse: fix bad inode
commit 5d069dbe8aaf2a197142558b6fb2978189ba3454 upstream.
Jan Kara's analysis of the syzbot report (edited):
The reproducer opens a directory on FUSE filesystem, it then attaches
dnotify mark to the open directory. After that a fuse_do_getattr() call
finds that attributes returned by the server are inconsistent, and calls
make_bad_inode() which, among other things does:
inode->i_mode = S_IFREG;
This then confuses dnotify which doesn't tear down its structures
properly and eventually crashes.
Avoid calling make_bad_inode() on a live inode: switch to a private flag on
the fuse inode. Also add the test to ops which the bad_inode_ops would
have caught.
This bug goes back to the initial merge of fuse in 2.6.14...
Reported-by: syzbot+f427adf9324b92652ccc@syzkaller.appspotmail.com
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Tested-by: Jan Kara <jack@suse.cz>
Cc: <stable@vger.kernel.org>
[bwh: Backported to 4.9:
- Drop changes in fuse_dir_fsync(), fuse_readahead(), fuse_evict_inode()
- In fuse_get_link(), return ERR_PTR(-EIO) for bad inodes
- Convert some additional calls to is_bad_inode()
- Adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Miklos Szeredi
Greg Kroah-Hartman
parent
ab5edcdd0e
commit
3a2f8823aa
@ -19,6 +19,9 @@ struct posix_acl *fuse_get_acl(struct inode *inode, int type)
|
||||
void *value = NULL;
|
||||
struct posix_acl *acl;
|
||||
|
||||
if (fuse_is_bad(inode))
|
||||
return ERR_PTR(-EIO);
|
||||
|
||||
if (!fc->posix_acl || fc->no_getxattr)
|
||||
return NULL;
|
||||
|
||||
@ -53,6 +56,9 @@ int fuse_set_acl(struct inode *inode, struct posix_acl *acl, int type)
|
||||
const char *name;
|
||||
int ret;
|
||||
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
if (!fc->posix_acl || fc->no_setxattr)
|
||||
return -EOPNOTSUPP;
|
||||
|
||||
|
||||
@ -187,7 +187,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
|
||||
int ret;
|
||||
|
||||
inode = d_inode_rcu(entry);
|
||||
if (inode && is_bad_inode(inode))
|
||||
if (inode && fuse_is_bad(inode))
|
||||
goto invalid;
|
||||
else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) ||
|
||||
(flags & LOOKUP_REVAL)) {
|
||||
@ -364,6 +364,9 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
|
||||
bool outarg_valid = true;
|
||||
bool locked;
|
||||
|
||||
if (fuse_is_bad(dir))
|
||||
return ERR_PTR(-EIO);
|
||||
|
||||
locked = fuse_lock_inode(dir);
|
||||
err = fuse_lookup_name(dir->i_sb, get_node_id(dir), &entry->d_name,
|
||||
&outarg, &inode);
|
||||
@ -504,6 +507,9 @@ static int fuse_atomic_open(struct inode *dir, struct dentry *entry,
|
||||
struct fuse_conn *fc = get_fuse_conn(dir);
|
||||
struct dentry *res = NULL;
|
||||
|
||||
if (fuse_is_bad(dir))
|
||||
return -EIO;
|
||||
|
||||
if (d_in_lookup(entry)) {
|
||||
res = fuse_lookup(dir, entry, 0);
|
||||
if (IS_ERR(res))
|
||||
@ -551,6 +557,9 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_args *args,
|
||||
int err;
|
||||
struct fuse_forget_link *forget;
|
||||
|
||||
if (fuse_is_bad(dir))
|
||||
return -EIO;
|
||||
|
||||
forget = fuse_alloc_forget();
|
||||
if (!forget)
|
||||
return -ENOMEM;
|
||||
@ -672,6 +681,9 @@ static int fuse_unlink(struct inode *dir, struct dentry *entry)
|
||||
struct fuse_conn *fc = get_fuse_conn(dir);
|
||||
FUSE_ARGS(args);
|
||||
|
||||
if (fuse_is_bad(dir))
|
||||
return -EIO;
|
||||
|
||||
args.in.h.opcode = FUSE_UNLINK;
|
||||
args.in.h.nodeid = get_node_id(dir);
|
||||
args.in.numargs = 1;
|
||||
@ -708,6 +720,9 @@ static int fuse_rmdir(struct inode *dir, struct dentry *entry)
|
||||
struct fuse_conn *fc = get_fuse_conn(dir);
|
||||
FUSE_ARGS(args);
|
||||
|
||||
if (fuse_is_bad(dir))
|
||||
return -EIO;
|
||||
|
||||
args.in.h.opcode = FUSE_RMDIR;
|
||||
args.in.h.nodeid = get_node_id(dir);
|
||||
args.in.numargs = 1;
|
||||
@ -786,6 +801,9 @@ static int fuse_rename2(struct inode *olddir, struct dentry *oldent,
|
||||
struct fuse_conn *fc = get_fuse_conn(olddir);
|
||||
int err;
|
||||
|
||||
if (fuse_is_bad(olddir))
|
||||
return -EIO;
|
||||
|
||||
if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE))
|
||||
return -EINVAL;
|
||||
|
||||
@ -921,7 +939,7 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat,
|
||||
if (!err) {
|
||||
if (fuse_invalid_attr(&outarg.attr) ||
|
||||
(inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
|
||||
make_bad_inode(inode);
|
||||
fuse_make_bad(inode);
|
||||
err = -EIO;
|
||||
} else {
|
||||
fuse_change_attributes(inode, &outarg.attr,
|
||||
@ -1114,6 +1132,9 @@ static int fuse_permission(struct inode *inode, int mask)
|
||||
bool refreshed = false;
|
||||
int err = 0;
|
||||
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
if (!fuse_allow_current_process(fc))
|
||||
return -EACCES;
|
||||
|
||||
@ -1251,7 +1272,7 @@ retry:
|
||||
dput(dentry);
|
||||
goto retry;
|
||||
}
|
||||
if (is_bad_inode(inode)) {
|
||||
if (fuse_is_bad(inode)) {
|
||||
dput(dentry);
|
||||
return -EIO;
|
||||
}
|
||||
@ -1349,7 +1370,7 @@ static int fuse_readdir(struct file *file, struct dir_context *ctx)
|
||||
u64 attr_version = 0;
|
||||
bool locked;
|
||||
|
||||
if (is_bad_inode(inode))
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
req = fuse_get_req(fc, 1);
|
||||
@ -1409,6 +1430,9 @@ static const char *fuse_get_link(struct dentry *dentry,
|
||||
if (!dentry)
|
||||
return ERR_PTR(-ECHILD);
|
||||
|
||||
if (fuse_is_bad(inode))
|
||||
return ERR_PTR(-EIO);
|
||||
|
||||
link = kmalloc(PAGE_SIZE, GFP_KERNEL);
|
||||
if (!link)
|
||||
return ERR_PTR(-ENOMEM);
|
||||
@ -1707,7 +1731,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr,
|
||||
|
||||
if (fuse_invalid_attr(&outarg.attr) ||
|
||||
(inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
|
||||
make_bad_inode(inode);
|
||||
fuse_make_bad(inode);
|
||||
err = -EIO;
|
||||
goto error;
|
||||
}
|
||||
@ -1763,6 +1787,9 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
|
||||
struct file *file = (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL;
|
||||
int ret;
|
||||
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
if (!fuse_allow_current_process(get_fuse_conn(inode)))
|
||||
return -EACCES;
|
||||
|
||||
@ -1821,6 +1848,9 @@ static int fuse_getattr(struct vfsmount *mnt, struct dentry *entry,
|
||||
struct inode *inode = d_inode(entry);
|
||||
struct fuse_conn *fc = get_fuse_conn(inode);
|
||||
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
if (!fuse_allow_current_process(fc))
|
||||
return -EACCES;
|
||||
|
||||
|
||||
@ -206,6 +206,9 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
|
||||
fc->atomic_o_trunc &&
|
||||
fc->writeback_cache;
|
||||
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
err = generic_file_open(inode, file);
|
||||
if (err)
|
||||
return err;
|
||||
@ -411,7 +414,7 @@ static int fuse_flush(struct file *file, fl_owner_t id)
|
||||
struct fuse_flush_in inarg;
|
||||
int err;
|
||||
|
||||
if (is_bad_inode(inode))
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
if (fc->no_flush)
|
||||
@ -459,7 +462,7 @@ int fuse_fsync_common(struct file *file, loff_t start, loff_t end,
|
||||
struct fuse_fsync_in inarg;
|
||||
int err;
|
||||
|
||||
if (is_bad_inode(inode))
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
inode_lock(inode);
|
||||
@ -771,7 +774,7 @@ static int fuse_readpage(struct file *file, struct page *page)
|
||||
int err;
|
||||
|
||||
err = -EIO;
|
||||
if (is_bad_inode(inode))
|
||||
if (fuse_is_bad(inode))
|
||||
goto out;
|
||||
|
||||
err = fuse_do_readpage(file, page);
|
||||
@ -898,7 +901,7 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
|
||||
int nr_alloc = min_t(unsigned, nr_pages, FUSE_MAX_PAGES_PER_REQ);
|
||||
|
||||
err = -EIO;
|
||||
if (is_bad_inode(inode))
|
||||
if (fuse_is_bad(inode))
|
||||
goto out;
|
||||
|
||||
data.file = file;
|
||||
@ -928,6 +931,9 @@ static ssize_t fuse_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
|
||||
struct inode *inode = iocb->ki_filp->f_mapping->host;
|
||||
struct fuse_conn *fc = get_fuse_conn(inode);
|
||||
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
/*
|
||||
* In auto invalidate mode, always update attributes on read.
|
||||
* Otherwise, only update if we attempt to read past EOF (to ensure
|
||||
@ -1123,7 +1129,7 @@ static ssize_t fuse_perform_write(struct file *file,
|
||||
int err = 0;
|
||||
ssize_t res = 0;
|
||||
|
||||
if (is_bad_inode(inode))
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
if (inode->i_size < pos + iov_iter_count(ii))
|
||||
@ -1180,6 +1186,9 @@ static ssize_t fuse_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
|
||||
ssize_t err;
|
||||
loff_t endbyte = 0;
|
||||
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
if (get_fuse_conn(inode)->writeback_cache) {
|
||||
/* Update size (EOF optimization) and mode (SUID clearing) */
|
||||
err = fuse_update_attributes(mapping->host, NULL, file, NULL);
|
||||
@ -1415,7 +1424,7 @@ static ssize_t __fuse_direct_read(struct fuse_io_priv *io,
|
||||
struct file *file = io->file;
|
||||
struct inode *inode = file_inode(file);
|
||||
|
||||
if (is_bad_inode(inode))
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
res = fuse_direct_io(io, iter, ppos, 0);
|
||||
@ -1438,7 +1447,7 @@ static ssize_t fuse_direct_write_iter(struct kiocb *iocb, struct iov_iter *from)
|
||||
struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(file);
|
||||
ssize_t res;
|
||||
|
||||
if (is_bad_inode(inode))
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
/* Don't allow parallel writes to the same file */
|
||||
@ -1911,7 +1920,7 @@ static int fuse_writepages(struct address_space *mapping,
|
||||
int err;
|
||||
|
||||
err = -EIO;
|
||||
if (is_bad_inode(inode))
|
||||
if (fuse_is_bad(inode))
|
||||
goto out;
|
||||
|
||||
data.inode = inode;
|
||||
@ -2687,7 +2696,7 @@ long fuse_ioctl_common(struct file *file, unsigned int cmd,
|
||||
if (!fuse_allow_current_process(fc))
|
||||
return -EACCES;
|
||||
|
||||
if (is_bad_inode(inode))
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
return fuse_do_ioctl(file, cmd, arg, flags);
|
||||
|
||||
@ -115,6 +115,8 @@ enum {
|
||||
FUSE_I_INIT_RDPLUS,
|
||||
/** An operation changing file size is in progress */
|
||||
FUSE_I_SIZE_UNSTABLE,
|
||||
/* Bad inode */
|
||||
FUSE_I_BAD,
|
||||
};
|
||||
|
||||
struct fuse_conn;
|
||||
@ -688,6 +690,16 @@ static inline u64 get_node_id(struct inode *inode)
|
||||
return get_fuse_inode(inode)->nodeid;
|
||||
}
|
||||
|
||||
static inline void fuse_make_bad(struct inode *inode)
|
||||
{
|
||||
set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state);
|
||||
}
|
||||
|
||||
static inline bool fuse_is_bad(struct inode *inode)
|
||||
{
|
||||
return unlikely(test_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state));
|
||||
}
|
||||
|
||||
/** Device operations */
|
||||
extern const struct file_operations fuse_dev_operations;
|
||||
|
||||
|
||||
@ -316,7 +316,7 @@ struct inode *fuse_iget(struct super_block *sb, u64 nodeid,
|
||||
unlock_new_inode(inode);
|
||||
} else if ((inode->i_mode ^ attr->mode) & S_IFMT) {
|
||||
/* Inode has changed type, any I/O on the old should fail */
|
||||
make_bad_inode(inode);
|
||||
fuse_make_bad(inode);
|
||||
iput(inode);
|
||||
goto retry;
|
||||
}
|
||||
|
||||
@ -113,6 +113,9 @@ ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size)
|
||||
struct fuse_getxattr_out outarg;
|
||||
ssize_t ret;
|
||||
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
if (!fuse_allow_current_process(fc))
|
||||
return -EACCES;
|
||||
|
||||
@ -178,6 +181,9 @@ static int fuse_xattr_get(const struct xattr_handler *handler,
|
||||
struct dentry *dentry, struct inode *inode,
|
||||
const char *name, void *value, size_t size)
|
||||
{
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
return fuse_getxattr(inode, name, value, size);
|
||||
}
|
||||
|
||||
@ -186,6 +192,9 @@ static int fuse_xattr_set(const struct xattr_handler *handler,
|
||||
const char *name, const void *value, size_t size,
|
||||
int flags)
|
||||
{
|
||||
if (fuse_is_bad(inode))
|
||||
return -EIO;
|
||||
|
||||
if (!value)
|
||||
return fuse_removexattr(inode, name);
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user