Re: [PATCH 4.14,4.19 1/2] fuse: fix bad inode

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Jan 24, 2022 at 04:17:18PM +0100, Ben Hutchings wrote:
> From: Miklos Szeredi <mszeredi@xxxxxxxxxx>
> 
> commit 5d069dbe8aaf2a197142558b6fb2978189ba3454 upstream.
> 
> Jan Kara's analysis of the syzbot report (edited):
> 
>   The reproducer opens a directory on FUSE filesystem, it then attaches
>   dnotify mark to the open directory.  After that a fuse_do_getattr() call
>   finds that attributes returned by the server are inconsistent, and calls
>   make_bad_inode() which, among other things does:
> 
>           inode->i_mode = S_IFREG;
> 
>   This then confuses dnotify which doesn't tear down its structures
>   properly and eventually crashes.
> 
> Avoid calling make_bad_inode() on a live inode: switch to a private flag on
> the fuse inode.  Also add the test to ops which the bad_inode_ops would
> have caught.
> 
> This bug goes back to the initial merge of fuse in 2.6.14...
> 
> Reported-by: syzbot+f427adf9324b92652ccc@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Miklos Szeredi <mszeredi@xxxxxxxxxx>
> Tested-by: Jan Kara <jack@xxxxxxx>
> Cc: <stable@xxxxxxxxxxxxxxx>
> [bwh: Backported to 4.19:
>  - Drop changes in fuse_dir_fsync(), fuse_readahead(), fuse_evict_inode()
>  - In fuse_get_link(), return ERR_PTR(-EIO) for bad inodes
>  - Convert some additional calls to is_bad_inode()
>  - Adjust filename, context]
> Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx>

Both now queued up, thanks!

greg k-h



[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux