Commit 9a254403 authored by yangerkun's avatar yangerkun Committed by Miklos Szeredi
Browse files

ovl: fix use after free in struct ovl_aio_req 



Example for triggering use after free in a overlay on ext4 setup:

aio_read
  ovl_read_iter
    vfs_iter_read
      ext4_file_read_iter
        ext4_dio_read_iter
          iomap_dio_rw -> -EIOCBQUEUED
          /*
	   * Here IO is completed in a separate thread,
	   * ovl_aio_cleanup_handler() frees aio_req which has iocb embedded
	   */
          file_accessed(iocb->ki_filp); /**BOOM**/

Fix by introducing a refcount in ovl_aio_req similarly to aio_kiocb.  This
guarantees that iocb is only freed after vfs_read/write_iter() returns on
underlying fs.

Fixes: 2406a307 ("ovl: implement async IO routines")
Signed-off-by: default avataryangerkun <yangerkun@huawei.com>
Link: https://lore.kernel.org/r/20210930032228.3199690-3-yangerkun@huawei.com/


Cc: <stable@vger.kernel.org> # v5.6
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
parent 1dc1eed4

fs/overlayfs/file.c

+14 −2
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 


struct ovl_aio_req {

	struct kiocb iocb;

	refcount_t ref;

	struct kiocb *orig_iocb;

	struct fd fd;

};
@@ -252,6 +253,14 @@ static rwf_t ovl_iocb_to_rwf(int ifl) 
	return flags;

}



static inline void ovl_aio_put(struct ovl_aio_req *aio_req)

{

	if (refcount_dec_and_test(&aio_req->ref)) {

		fdput(aio_req->fd);

		kmem_cache_free(ovl_aio_request_cachep, aio_req);

	}

}



static void ovl_aio_cleanup_handler(struct ovl_aio_req *aio_req)

{

	struct kiocb *iocb = &aio_req->iocb;
@@ -268,8 +277,7 @@ static void ovl_aio_cleanup_handler(struct ovl_aio_req *aio_req) 
	}



	orig_iocb->ki_pos = iocb->ki_pos;

	fdput(aio_req->fd);

	kmem_cache_free(ovl_aio_request_cachep, aio_req);

	ovl_aio_put(aio_req);

}



static void ovl_aio_rw_complete(struct kiocb *iocb, long res, long res2)
@@ -319,7 +327,9 @@ static ssize_t ovl_read_iter(struct kiocb *iocb, struct iov_iter *iter) 
		aio_req->orig_iocb = iocb;

		kiocb_clone(&aio_req->iocb, iocb, real.file);

		aio_req->iocb.ki_complete = ovl_aio_rw_complete;

		refcount_set(&aio_req->ref, 2);

		ret = vfs_iocb_iter_read(real.file, &aio_req->iocb, iter);

		ovl_aio_put(aio_req);

		if (ret != -EIOCBQUEUED)

			ovl_aio_cleanup_handler(aio_req);

	}
@@ -390,7 +400,9 @@ static ssize_t ovl_write_iter(struct kiocb *iocb, struct iov_iter *iter) 
		kiocb_clone(&aio_req->iocb, iocb, real.file);

		aio_req->iocb.ki_flags = ifl;

		aio_req->iocb.ki_complete = ovl_aio_rw_complete;

		refcount_set(&aio_req->ref, 2);

		ret = vfs_iocb_iter_write(real.file, &aio_req->iocb, iter);

		ovl_aio_put(aio_req);

		if (ret != -EIOCBQUEUED)

			ovl_aio_cleanup_handler(aio_req);

	}