On Wed, Jan 19, 2022 at 09:04:36AM -0800, Samuel Mendoza-Jonas wrote: > On Wed, Jan 19, 2022 at 12:37:54PM +0100, Greg KH wrote: > > CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe. > > > > > > > > On Tue, Jan 18, 2022 at 04:52:00PM -0800, Samuel Mendoza-Jonas wrote: > > > From: Miklos Szeredi <mszeredi@xxxxxxxxxx> > > > > > > commit 5d069dbe8aaf2a197142558b6fb2978189ba3454 upstream. > > > > > > Jan Kara's analysis of the syzbot report (edited): > > > > > > The reproducer opens a directory on FUSE filesystem, it then attaches > > > dnotify mark to the open directory. After that a fuse_do_getattr() call > > > finds that attributes returned by the server are inconsistent, and calls > > > make_bad_inode() which, among other things does: > > > > > > inode->i_mode = S_IFREG; > > > > > > This then confuses dnotify which doesn't tear down its structures > > > properly and eventually crashes. > > > > > > Avoid calling make_bad_inode() on a live inode: switch to a private flag on > > > the fuse inode. Also add the test to ops which the bad_inode_ops would > > > have caught. > > > > > > This bug goes back to the initial merge of fuse in 2.6.14... > > > > > > Reported-by: syzbot+f427adf9324b92652ccc@xxxxxxxxxxxxxxxxxxxxxxxxx > > > Signed-off-by: Miklos Szeredi <mszeredi@xxxxxxxxxx> > > > Tested-by: Jan Kara <jack@xxxxxxx> > > > Cc: <stable@xxxxxxxxxxxxxxx> > > > [adjusted for missing fs/fuse/readdir.c and changes in fuse_evict_inode() in 4.14] > > > Signed-off-by: Samuel Mendoza-Jonas <samjonas@xxxxxxxxxx> > > > > What about 4.19.y, will this work there as well? We need it for that > > kernel before we can take it into 4.14.y. > > > > Also what about 4.4.y and 4.9.y? > > Hi, > > This applies & builds on 4.19.y and 4.9.y fine as well, 4.4.y runs into > a conflict which I'll have a closer look at. Ok, thanks, now queued up. greg k-h
