On Mon, Jan 24, 2022 at 04:17:18PM +0100, Ben Hutchings wrote: > From: Miklos Szeredi <mszeredi@xxxxxxxxxx> > > commit 5d069dbe8aaf2a197142558b6fb2978189ba3454 upstream. > > Jan Kara's analysis of the syzbot report (edited): > > The reproducer opens a directory on FUSE filesystem, it then attaches > dnotify mark to the open directory. After that a fuse_do_getattr() call > finds that attributes returned by the server are inconsistent, and calls > make_bad_inode() which, among other things does: > > inode->i_mode = S_IFREG; > > This then confuses dnotify which doesn't tear down its structures > properly and eventually crashes. > > Avoid calling make_bad_inode() on a live inode: switch to a private flag on > the fuse inode. Also add the test to ops which the bad_inode_ops would > have caught. > > This bug goes back to the initial merge of fuse in 2.6.14... > > Reported-by: syzbot+f427adf9324b92652ccc@xxxxxxxxxxxxxxxxxxxxxxxxx > Signed-off-by: Miklos Szeredi <mszeredi@xxxxxxxxxx> > Tested-by: Jan Kara <jack@xxxxxxx> > Cc: <stable@xxxxxxxxxxxxxxx> > [bwh: Backported to 4.19: > - Drop changes in fuse_dir_fsync(), fuse_readahead(), fuse_evict_inode() > - In fuse_get_link(), return ERR_PTR(-EIO) for bad inodes > - Convert some additional calls to is_bad_inode() > - Adjust filename, context] > Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx> Both now queued up, thanks! greg k-h
