On 2022/11/24 20:45, Miklos Szeredi wrote:
On Thu, Nov 24, 2022 at 05:26:02PM +0800, Chen Zhongjin wrote:
syzkaller reported a null-ptr-deref error:
https://syzkaller.appspot.com/bug?id=bb281e89381b9ed55728c274447a575e69a96c35
ovl_dentry_revalidate_common() can be called in rcu-walk mode.
As document said, "in rcu-walk mode, d_parent and d_inode should not be
used without care". Check inode here to protect access under rcu-walk
mode.
Fixes: bccece1ead36 ("ovl: allow remote upper")
Reported-by: syzbot+a4055c78774bbf3498bb@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Chen Zhongjin <chenzhongjin@xxxxxxxxxx>
Hi,
Thanks for the quick analysis and patch.
I simplified the patch a bit without changing the attribution.
Thanks,
Miklos
----
From: Chen Zhongjin <chenzhongjin@xxxxxxxxxx>
Subject: ovl: fix use inode directly in rcu-walk mode
ovl_dentry_revalidate_common() can be called in rcu-walk mode. As document
said, "in rcu-walk mode, d_parent and d_inode should not be used without
care".
Check inode here to protect access under rcu-walk mode.
Fixes: bccece1ead36 ("ovl: allow remote upper")
Reported-by: syzbot+a4055c78774bbf3498bb@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Chen Zhongjin <chenzhongjin@xxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx> # v5.7
Signed-off-by: Miklos Szeredi <mszeredi@xxxxxxxxxx>
---
fs/overlayfs/super.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -139,11 +139,16 @@ static int ovl_dentry_revalidate_common(
unsigned int flags, bool weak)
{
struct ovl_entry *oe = dentry->d_fsdata;
+ struct inode *inode = d_inode_rcu(dentry);
struct dentry *upper;
unsigned int i;
int ret = 1;
- upper = ovl_dentry_upper(dentry);
+ /* Careful in RCU mode */
+ if (!inode)
+ return -ECHILD;
+
+ upper = ovl_i_dentry_upper(inode);
if (upper)
ret = ovl_revalidate_real(upper, flags, weak);
Thanks for review! LGTM
Best,
Chen
