For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] fs/namei: fix UAF in pick_link() by unlazying before atime check
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


In pick_link(), atime_needs_update() is called while the path walk
may still be in RCU mode (LOOKUP_RCU set), meaning no reference is
held on the inode. A concurrent iput() from another task can free
the inode while atime_needs_update() reads inode->i_opflags (offset
+2) inside current_time() -> is_mgtime(), causing a use-after-free.

KASAN reports:
  BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313
  Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags)

The race:
  Task A (pick_link)             Task B (unlinkat)
  ------------------             -----------------
  atime_needs_update(inode)      iput(inode)
    current_time(inode)            evict()
      is_mgtime(inode)               destroy_inode()
        inode->i_opflags  UAF          inode FREED

Fix: call try_to_unlazy() before atime_needs_update() so that
a proper inode reference is held before any inode fields are read.
If try_to_unlazy() detects the inode is already gone, it returns
false and we exit safely with -ECHILD without touching freed memory.

Reported-by: syzbot+36e50496c8ac4bcde3f9@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=36e50496c8ac4bcde3f9
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>"
---
 fs/namei.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/namei.c b/fs/namei.c
index c7fac83c9a85..eac0ec35be37 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2037,11 +2037,11 @@ static noinline const char *pick_link(struct nameidata *nd, struct path *link,
 			unlikely(link->mnt->mnt_flags & MNT_NOSYMFOLLOW))
 		return ERR_PTR(-ELOOP);
 
+	if (nd->flags & LOOKUP_RCU) {
+		if (!try_to_unlazy(nd))
+			return ERR_PTR(-ECHILD);
+	}
 	if (unlikely(atime_needs_update(&last->link, inode))) {
-		if (nd->flags & LOOKUP_RCU) {
-			if (!try_to_unlazy(nd))
-				return ERR_PTR(-ECHILD);
-		}
 		touch_atime(&last->link);
 		cond_resched();
 	}
-- 
2.43.0