On Wed, 2022-08-17 at 18:33 +0100, David Howells wrote:
> Prior to commit 4149be7bda7e, sys_flock() would allocate the file_lock
> struct it was going to use to pass parameters, call ->flock() and then call
> locks_free_lock() to get rid of it - which had the side effect of calling
> locks_release_private() and thus ->fl_release_private().
>
> With commit 4149be7bda7e, however, this is no longer the case: the struct
> is now allocated on the stack, and locks_free_lock() is no longer called -
> and thus any remaining private data doesn't get cleaned up either.
>
> This causes afs flock to cause oops. Kasan catches this as a UAF by the
> list_del_init() in afs_fl_release_private() for the file_lock record
> produced by afs_fl_copy_lock() as the original record didn't get delisted.
> It can be reproduced using the generic/504 xfstest.
>
> Fix this by reinstating the locks_release_private() call in sys_flock().
> I'm not sure if this would affect any other filesystems. If not, then the
> release could be done in afs_flock() instead.
>
> Fixes: 4149be7bda7e ("fs/lock: Don't allocate file_lock in flock_make_lock().")
> cc: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
> cc: Chuck Lever <chuck.lever@xxxxxxxxxx>
> cc: Jeff Layton <jlayton@xxxxxxxxxx>
> cc: Marc Dionne <marc.dionne@xxxxxxxxxxxx>
> cc: linux-afs@xxxxxxxxxxxxxxxxxxx
> cc: linux-fsdevel@xxxxxxxxxxxxxxx
> ---
>
> fs/locks.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/fs/locks.c b/fs/locks.c
> index c266cfdc3291..f2d5aca782c6 100644
> --- a/fs/locks.c
> +++ b/fs/locks.c
> @@ -2116,7 +2116,7 @@ SYSCALL_DEFINE2(flock, unsigned int, fd, unsigned int, cmd)
>
> error = security_file_lock(f.file, fl.fl_type);
> if (error)
> - goto out_putf;
> + goto out_release;
It probably doesn't hurt anything, but I don't think it's necessary to
call locks_release_private if the ->flock op was never called.
>
> can_sleep = !(cmd & LOCK_NB);
> if (can_sleep)
> @@ -2128,7 +2128,8 @@ SYSCALL_DEFINE2(flock, unsigned int, fd, unsigned int, cmd)
> &fl);
> else
> error = locks_lock_file_wait(f.file, &fl);
> -
> +out_release:
> + locks_release_private(&fl);
^^^
I think we just need the above line.
> out_putf:
> fdput(f);
>
>
>
--
Jeff Layton <jlayton@xxxxxxxxxx>
