Commit 26a6e7f6 authored by yangerkun's avatar yangerkun Committed by Yu Kuai
Browse files

libfs: fix infinite directory reads for offset dir 

mainline inclusion
from mainline-v6.11-rc4
commit 64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR5GW
CVE: CVE-2024-46701

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a



--------------------------------

After we switch tmpfs dir operations from simple_dir_operations to
simple_offset_dir_operations, every rename happened will fill new dentry
to dest dir's maple tree(&SHMEM_I(inode)->dir_offsets->mt) with a free
key starting with octx->newx_offset, and then set newx_offset equals to
free key + 1. This will lead to infinite readdir combine with rename
happened at the same time, which fail generic/736 in xfstests(detail show
as below).

1. create 5000 files(1 2 3...) under one dir
2. call readdir(man 3 readdir) once, and get one entry
3. rename(entry, "TEMPFILE"), then rename("TEMPFILE", entry)
4. loop 2~3, until readdir return nothing or we loop too many
   times(tmpfs break test with the second condition)

We choose the same logic what commit 9b378f6a ("btrfs: fix infinite
directory reads") to fix it, record the last_index when we open dir, and
do not emit the entry which index >= last_index. The file->private_data
now used in offset dir can use directly to do this, and we also update
the last_index when we llseek the dir file.

Fixes: a2e45955 ("shmem: stable directory offsets")
Signed-off-by: default avataryangerkun <yangerkun@huawei.com>
Link: https://lore.kernel.org/r/20240731043835.1828697-1-yangerkun@huawei.com


Reviewed-by: default avatarChuck Lever <chuck.lever@oracle.com>
[brauner: only update last_index after seek when offset is zero like Jan suggested]
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
Signed-off-by: default avatarYu Kuai <yukuai3@huawei.com>
parent 01fac170

fs/libfs.c

+24 −11
Original line number Diff line number Diff line
@@ -405,6 +405,14 @@ void simple_offset_destroy(struct offset_ctx *octx) 
	mtree_destroy(&octx->mt);

}



static int offset_dir_open(struct inode *inode, struct file *file)

{

	struct offset_ctx *ctx = inode->i_op->get_offset_ctx(inode);



	file->private_data = (void *)ctx->next_offset;

	return 0;

}



/**

 * offset_dir_llseek - Advance the read position of a directory descriptor

 * @file: an open directory whose position is to be updated
@@ -418,6 +426,9 @@ void simple_offset_destroy(struct offset_ctx *octx) 
 */

static loff_t offset_dir_llseek(struct file *file, loff_t offset, int whence)

{

	struct inode *inode = file->f_inode;

	struct offset_ctx *ctx = inode->i_op->get_offset_ctx(inode);



	switch (whence) {

	case SEEK_CUR:

		offset += file->f_pos;
@@ -431,7 +442,8 @@ static loff_t offset_dir_llseek(struct file *file, loff_t offset, int whence) 
	}



	/* In this case, ->private_data is protected by f_pos_lock */

	file->private_data = NULL;

	if (!offset)

		file->private_data = (void *)ctx->next_offset;

	return vfs_setpos(file, offset, LONG_MAX);

}
@@ -462,7 +474,7 @@ static bool offset_dir_emit(struct dir_context *ctx, struct dentry *dentry) 
			  inode->i_ino, fs_umode_to_dtype(inode->i_mode));

}



static void *offset_iterate_dir(struct inode *inode, struct dir_context *ctx)

static void offset_iterate_dir(struct inode *inode, struct dir_context *ctx, long last_index)

{

	struct offset_ctx *octx = inode->i_op->get_offset_ctx(inode);

	struct dentry *dentry;
@@ -470,17 +482,21 @@ static void *offset_iterate_dir(struct inode *inode, struct dir_context *ctx) 
	while (true) {

		dentry = offset_find_next(octx, ctx->pos);

		if (!dentry)

			return ERR_PTR(-ENOENT);

			return;



		if (dentry2offset(dentry) >= last_index) {

			dput(dentry);

			return;

		}



		if (!offset_dir_emit(ctx, dentry)) {

			dput(dentry);

			break;

			return;

		}



		ctx->pos = dentry2offset(dentry) + 1;

		dput(dentry);

	}

	return NULL;

}



/**
@@ -507,22 +523,19 @@ static void *offset_iterate_dir(struct inode *inode, struct dir_context *ctx) 
static int offset_readdir(struct file *file, struct dir_context *ctx)

{

	struct dentry *dir = file->f_path.dentry;

	long last_index = (long)file->private_data;



	lockdep_assert_held(&d_inode(dir)->i_rwsem);



	if (!dir_emit_dots(file, ctx))

		return 0;



	/* In this case, ->private_data is protected by f_pos_lock */

	if (ctx->pos == DIR_OFFSET_MIN)

		file->private_data = NULL;

	else if (file->private_data == ERR_PTR(-ENOENT))

		return 0;

	file->private_data = offset_iterate_dir(d_inode(dir), ctx);

	offset_iterate_dir(d_inode(dir), ctx, last_index);

	return 0;

}



const struct file_operations simple_offset_dir_operations = {

	.open		= offset_dir_open,

	.llseek		= offset_dir_llseek,

	.iterate_shared	= offset_readdir,

	.read		= generic_read_dir,