Commit 52191957 authored by Edward Adam Davis's avatar Edward Adam Davis Committed by Xiangwei Li
Browse files

nilfs2: prevent use of deleted inode 

stable inclusion
from stable-v6.6.68
commit 284760b320a0bac411b18108316939707dccb12b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJC7J
CVE: CVE-2024-53690

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=284760b320a0bac411b18108316939707dccb12b

--------------------------------

commit 901ce9705fbb9f330ff1f19600e5daf9770b0175 upstream.

syzbot reported a WARNING in nilfs_rmdir. [1]

Because the inode bitmap is corrupted, an inode with an inode number that
should exist as a ".nilfs" file was reassigned by nilfs_mkdir for "file0",
causing an inode duplication during execution.  And this causes an
underflow of i_nlink in rmdir operations.

The inode is used twice by the same task to unmount and remove directories
".nilfs" and "file0", it trigger warning in nilfs_rmdir.

Avoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means
that this inode has been deleted, and iput is executed to reclaim it.

[1]
WARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407
...
Call Trace:
 <TASK>
 nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342
 vfs_rmdir+0x3a3/0x510 fs/namei.c:4394
 do_rmdir+0x3b5/0x580 fs/namei.c:4453
 __do_sys_rmdir fs/namei.c:4472 [inline]
 __se_sys_rmdir fs/namei.c:4470 [inline]
 __x64_sys_rmdir+0x47/0x50 fs/namei.c:4470
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Link: https://lkml.kernel.org/r/20241209065759.6781-1-konishi.ryusuke@gmail.com


Fixes: d2500652 ("nilfs2: pathname operations")
Signed-off-by: default avatarRyusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: default avatar <syzbot+9260555647a5132edd48@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=9260555647a5132edd48


Tested-by: default avatar <syzbot+9260555647a5132edd48@syzkaller.appspotmail.com>
Signed-off-by: default avatarEdward Adam Davis <eadavis@qq.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarXiangwei Li <liwei728@huawei.com>
parent ba86cb63

fs/nilfs2/inode.c

+7 −1
Original line number Diff line number Diff line
@@ -614,8 +614,14 @@ struct inode *nilfs_iget(struct super_block *sb, struct nilfs_root *root, 
	inode = nilfs_iget_locked(sb, root, ino);

	if (unlikely(!inode))

		return ERR_PTR(-ENOMEM);

	if (!(inode->i_state & I_NEW))



	if (!(inode->i_state & I_NEW)) {

		if (!inode->i_nlink) {

			iput(inode);

			return ERR_PTR(-ESTALE);

		}

		return inode;

	}



	err = __nilfs_read_inode(sb, root, ino, inode);

	if (unlikely(err)) {

fs/nilfs2/namei.c

+5 −0
Original line number Diff line number Diff line
@@ -67,6 +67,11 @@ nilfs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) 
		inode = NULL;

	} else {

		inode = nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino);

		if (inode == ERR_PTR(-ESTALE)) {

			nilfs_error(dir->i_sb,

					"deleted inode referenced: %lu", ino);

			return ERR_PTR(-EIO);

		}

	}



	return d_splice_alias(inode, dentry);