Commit 65197a1b authored by Jann Horn's avatar Jann Horn Committed by Yifan Qiao
Browse files

filelock: Fix fcntl/close race recovery compat path 

stable inclusion
from stable-v4.19.319
commit a561145f3ae973ebf3e0aee41624e92a6c5cb38d
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEF4
CVE: CVE-2024-41020

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a561145f3ae973ebf3e0aee41624e92a6c5cb38d

--------------------------------

commit f8138f2ad2f745b9a1c696a05b749eabe44337ea upstream.

When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when
fcntl/close race is detected"), I missed that there are two copies of the
code I was patching: The normal version, and the version for 64-bit offsets
on 32-bit kernels.
Thanks to Greg KH for stumbling over this while doing the stable
backport...

Apply exactly the same fix to the compat path for 32-bit kernels.

Fixes: c293621b ("[PATCH] stale POSIX lock handling")
Cc: stable@kernel.org
Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563


Signed-off-by: default avatarJann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20240723-fs-lock-recover-compatfix-v1-1-148096719529@google.com


Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarYifan Qiao <qiaoyifan4@huawei.com>
parent edea89b5

fs/locks.c

+4 −5
Original line number Original line Diff line number Diff line
@@ -2429,8 +2429,9 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, 
	error = do_lock_file_wait(filp, cmd, file_lock);

	error = do_lock_file_wait(filp, cmd, file_lock);





	/*

	/*

	 * Attempt to detect a close/fcntl race and recover by releasing the

	 * Detect close/fcntl races and recover by zapping all POSIX locks

	 * lock that was just acquired. There is no need to do that when we're

	 * associated with this file and our files_struct, just like on

	 * filp_flush(). There is no need to do that when we're

	 * unlocking though, or for OFD locks.

	 * unlocking though, or for OFD locks.

	 */

	 */

	if (!error && file_lock->fl_type != F_UNLCK &&

	if (!error && file_lock->fl_type != F_UNLCK &&
@@ -2444,9 +2445,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, 
		f = fcheck(fd);

		f = fcheck(fd);

		spin_unlock(&current->files->file_lock);

		spin_unlock(&current->files->file_lock);

		if (f != filp) {

		if (f != filp) {

			file_lock->fl_type = F_UNLCK;

			locks_remove_posix(filp, &current->files);

			error = do_lock_file_wait(filp, cmd, file_lock);

			WARN_ON_ONCE(error);

			error = -EBADF;

			error = -EBADF;

		}

		}

	}

	}