linux

iv/linux

History

yangerkun 4fd9f0509a ovl: fix use after free in struct ovl_aio_req

commit 9a254403760041528bc8f69fe2f5e1ef86950991 upstream.

Example for triggering use after free in a overlay on ext4 setup:

aio_read
  ovl_read_iter
    vfs_iter_read
      ext4_file_read_iter
        ext4_dio_read_iter
          iomap_dio_rw -> -EIOCBQUEUED
          /*
	   * Here IO is completed in a separate thread,
	   * ovl_aio_cleanup_handler() frees aio_req which has iocb embedded
	   */
          file_accessed(iocb->ki_filp); /**BOOM**/

Fix by introducing a refcount in ovl_aio_req similarly to aio_kiocb.  This
guarantees that iocb is only freed after vfs_read/write_iter() returns on
underlying fs.

Fixes: 2406a307ac7d ("ovl: implement async IO routines")
Signed-off-by: yangerkun <yangerkun@huawei.com>
Link: https://lore.kernel.org/r/20210930032228.3199690-3-yangerkun@huawei.com/
Cc: <stable@vger.kernel.org> # v5.6
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-11-18 14:03:49 +01:00

copy_up.c

ovl: fix missing revert_creds() on error path

2021-05-14 09:50:05 +02:00

dir.c

ovl: fix missing negative dentry check in ovl_rename()

2021-10-13 10:04:23 +02:00

export.c

ovl: fix uninitialized pointer read in ovl_lookup_real_one()

2021-09-03 10:09:22 +02:00

file.c

ovl: fix use after free in struct ovl_aio_req