From nobody Sun Nov 24 05:35:08 2024 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D8D941F473B; Thu, 7 Nov 2024 11:10:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.187 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1730977830; cv=none; b=Xrwyh16EQltw3uehu0I4843KemR8O5KUOFZO9ScaDWXFZMnut1wOfE3jOi3zA50gINA+mZmL2Qm1kcQ5G1CoyORo9hqekbDE0WPnBb9OCU1nVkIl2no7Mnx7B7jK4+rYQrjO2Qk79GidMjyk4IETcyZFRsQIWofwXrPykc6xE/Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1730977830; c=relaxed/simple; bh=oOOQlpxHRBpIsmicIcoxdHzfqDq12wkMpDouD22xBGU=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=omTEfLiSDsXHDWKPR5cuaqrGEQM6SbepUcaXI9Iqk3KpJA4X4vLavFSOiwn7qWuoMWlz4qXRoF+slhdIIHMoe31S5xZadOwLlUVJJQY2A83RygqDE6wOHWQDNNELcauZZlgPI0X/wCKTIfMj+/ot/zUcJYPoLgmTsmsuW4h4j9g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.187 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.88.105]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4XkfSN1F9mz10Qlh; Thu, 7 Nov 2024 19:08:04 +0800 (CST) Received: from kwepemf100017.china.huawei.com (unknown [7.202.181.16]) by mail.maildlp.com (Postfix) with ESMTPS id B7DF71400DC; Thu, 7 Nov 2024 19:10:25 +0800 (CST) Received: from huawei.com (10.175.104.67) by kwepemf100017.china.huawei.com (7.202.181.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 7 Nov 2024 19:10:24 +0800 From: Zizhi Wo To: , , , CC: , , , , , , , , , , Subject: [PATCH v2 4/5] cachefiles: Fix NULL pointer dereference in object->file Date: Thu, 7 Nov 2024 19:06:48 +0800 Message-ID: <20241107110649.3980193-5-wozizhi@huawei.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20241107110649.3980193-1-wozizhi@huawei.com> References: <20241107110649.3980193-1-wozizhi@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To kwepemf100017.china.huawei.com (7.202.181.16) Content-Type: text/plain; charset="utf-8" At present, the object->file has the NULL pointer dereference problem in ondemand-mode. The root cause is that the allocated fd and object->file lifetime are inconsistent, and the user-space invocation to anon_fd uses object->file. Following is the process that triggers the issue: [write fd] [umount] cachefiles_ondemand_fd_write_iter fscache_cookie_state_machine cachefiles_withdraw_cookie if (!file) return -ENOBUFS cachefiles_clean_up_object cachefiles_unmark_inode_in_use fput(object->file) object->file =3D NULL // file NULL pointer dereference! __cachefiles_write(..., file, ...) Fix this issue by add an additional reference count to the object->file before write/llseek, and decrement after it finished. Fixes: c8383054506c ("cachefiles: notify the user daemon when looking up co= okie") Signed-off-by: Zizhi Wo --- fs/cachefiles/interface.c | 14 ++++++++++---- fs/cachefiles/ondemand.c | 30 ++++++++++++++++++++++++------ 2 files changed, 34 insertions(+), 10 deletions(-) diff --git a/fs/cachefiles/interface.c b/fs/cachefiles/interface.c index 35ba2117a6f6..3e63cfe15874 100644 --- a/fs/cachefiles/interface.c +++ b/fs/cachefiles/interface.c @@ -327,6 +327,8 @@ static void cachefiles_commit_object(struct cachefiles_= object *object, static void cachefiles_clean_up_object(struct cachefiles_object *object, struct cachefiles_cache *cache) { + struct file *file; + if (test_bit(FSCACHE_COOKIE_RETIRED, &object->cookie->flags)) { if (!test_bit(CACHEFILES_OBJECT_USING_TMPFILE, &object->flags)) { cachefiles_see_object(object, cachefiles_obj_see_clean_delete); @@ -342,10 +344,14 @@ static void cachefiles_clean_up_object(struct cachefi= les_object *object, } =20 cachefiles_unmark_inode_in_use(object, object->file); - if (object->file) { - fput(object->file); - object->file =3D NULL; - } + + spin_lock(&object->lock); + file =3D object->file; + object->file =3D NULL; + spin_unlock(&object->lock); + + if (file) + fput(file); } =20 /* diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c index 38ca6dce8ef2..fe3de9ad57bf 100644 --- a/fs/cachefiles/ondemand.c +++ b/fs/cachefiles/ondemand.c @@ -60,20 +60,26 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct= kiocb *kiocb, { struct cachefiles_object *object =3D kiocb->ki_filp->private_data; struct cachefiles_cache *cache =3D object->volume->cache; - struct file *file =3D object->file; + struct file *file; size_t len =3D iter->count, aligned_len =3D len; loff_t pos =3D kiocb->ki_pos; const struct cred *saved_cred; int ret; =20 - if (!file) + spin_lock(&object->lock); + file =3D object->file; + if (!file) { + spin_unlock(&object->lock); return -ENOBUFS; + } + get_file(file); + spin_unlock(&object->lock); =20 cachefiles_begin_secure(cache, &saved_cred); ret =3D __cachefiles_prepare_write(object, file, &pos, &aligned_len, len,= true); cachefiles_end_secure(cache, saved_cred); if (ret < 0) - return ret; + goto out; =20 trace_cachefiles_ondemand_fd_write(object, file_inode(file), pos, len); ret =3D __cachefiles_write(object, file, pos, iter, NULL, NULL); @@ -82,6 +88,8 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct k= iocb *kiocb, kiocb->ki_pos +=3D ret; } =20 +out: + fput(file); return ret; } =20 @@ -89,12 +97,22 @@ static loff_t cachefiles_ondemand_fd_llseek(struct file= *filp, loff_t pos, int whence) { struct cachefiles_object *object =3D filp->private_data; - struct file *file =3D object->file; + struct file *file; + loff_t ret; =20 - if (!file) + spin_lock(&object->lock); + file =3D object->file; + if (!file) { + spin_unlock(&object->lock); return -ENOBUFS; + } + get_file(file); + spin_unlock(&object->lock); =20 - return vfs_llseek(file, pos, whence); + ret =3D vfs_llseek(file, pos, whence); + fput(file); + + return ret; } =20 static long cachefiles_ondemand_fd_ioctl(struct file *filp, unsigned int i= octl, --=20 2.39.2