Commit c312b264 authored by Ryusuke Konishi's avatar Ryusuke Konishi Committed by Guo Mengqi
Browse files

nilfs2: fix use-after-free of timer for log writer thread 

stable inclusion
from stable-v5.10.219
commit 67fa90d4a2ccd9ebb0e1e168c7d0b5d0cf3c7148
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S5D
CVE: CVE-2024-38583

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=67fa90d4a2ccd9ebb0e1e168c7d0b5d0cf3c7148

--------------------------------

commit f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 upstream.

Patch series "nilfs2: fix log writer related issues".

This bug fix series covers three nilfs2 log writer-related issues,
including a timer use-after-free issue and potential deadlock issue on
unmount, and a potential freeze issue in event synchronization found
during their analysis.  Details are described in each commit log.

This patch (of 3):

A use-after-free issue has been reported regarding the timer sc_timer on
the nilfs_sc_info structure.

The problem is that even though it is used to wake up a sleeping log
writer thread, sc_timer is not shut down until the nilfs_sc_info structure
is about to be freed, and is used regardless of the thread's lifetime.

Fix this issue by limiting the use of sc_timer only while the log writer
thread is alive.

Link: https://lkml.kernel.org/r/20240520132621.4054-1-konishi.ryusuke@gmail.com
Link: https://lkml.kernel.org/r/20240520132621.4054-2-konishi.ryusuke@gmail.com


Fixes: fdce895e ("nilfs2: change sc_timer from a pointer to an embedded one in struct nilfs_sc_info")
Signed-off-by: default avatarRyusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: default avatar"Bai, Shuangpeng" <sjb7183@psu.edu>
Closes: https://groups.google.com/g/syzkaller/c/MK_LYqtt8ko/m/8rgdWeseAwAJ


Tested-by: default avatarRyusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarGuo Mengqi <guomengqi3@huawei.com>
parent 223a7beb

fs/nilfs2/segment.c

+19 −6
Original line number Diff line number Diff line
@@ -2164,8 +2164,10 @@ static void nilfs_segctor_start_timer(struct nilfs_sc_info *sci) 
{

	spin_lock(&sci->sc_state_lock);

	if (!(sci->sc_state & NILFS_SEGCTOR_COMMIT)) {

		if (sci->sc_task) {

			sci->sc_timer.expires = jiffies + sci->sc_interval;

			add_timer(&sci->sc_timer);

		}

		sci->sc_state |= NILFS_SEGCTOR_COMMIT;

	}

	spin_unlock(&sci->sc_state_lock);
@@ -2385,9 +2387,20 @@ int nilfs_construct_dsync_segment(struct super_block *sb, struct inode *inode, 
 */

static void nilfs_segctor_accept(struct nilfs_sc_info *sci)

{

	bool thread_is_alive;



	spin_lock(&sci->sc_state_lock);

	sci->sc_seq_accepted = sci->sc_seq_request;

	thread_is_alive = (bool)sci->sc_task;

	spin_unlock(&sci->sc_state_lock);



	/*

	 * This function does not race with the log writer thread's

	 * termination.  Therefore, deleting sc_timer, which should not be

	 * done after the log writer thread exits, can be done safely outside

	 * the area protected by sc_state_lock.

	 */

	if (thread_is_alive)

		del_timer_sync(&sci->sc_timer);

}
@@ -2414,7 +2427,7 @@ static void nilfs_segctor_notify(struct nilfs_sc_info *sci, int mode, int err) 
			sci->sc_flush_request &= ~FLUSH_DAT_BIT;



		/* re-enable timer if checkpoint creation was not done */

		if ((sci->sc_state & NILFS_SEGCTOR_COMMIT) &&

		if ((sci->sc_state & NILFS_SEGCTOR_COMMIT) && sci->sc_task &&

		    time_before(jiffies, sci->sc_timer.expires))

			add_timer(&sci->sc_timer);

	}
@@ -2604,6 +2617,7 @@ static int nilfs_segctor_thread(void *arg) 
	int timeout = 0;



	sci->sc_timer_task = current;

	timer_setup(&sci->sc_timer, nilfs_construction_timeout, 0);



	/* start sync. */

	sci->sc_task = current;
@@ -2670,6 +2684,7 @@ static int nilfs_segctor_thread(void *arg) 
 end_thread:

	/* end sync. */

	sci->sc_task = NULL;

	del_timer_sync(&sci->sc_timer);

	wake_up(&sci->sc_wait_task); /* for nilfs_segctor_kill_thread() */

	spin_unlock(&sci->sc_state_lock);

	return 0;
@@ -2733,7 +2748,6 @@ static struct nilfs_sc_info *nilfs_segctor_new(struct super_block *sb, 
	INIT_LIST_HEAD(&sci->sc_gc_inodes);

	INIT_LIST_HEAD(&sci->sc_iput_queue);

	INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func);

	timer_setup(&sci->sc_timer, nilfs_construction_timeout, 0);



	sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT;

	sci->sc_mjcp_freq = HZ * NILFS_SC_DEFAULT_SR_FREQ;
@@ -2819,7 +2833,6 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci) 


	down_write(&nilfs->ns_segctor_sem);



	del_timer_sync(&sci->sc_timer);

	kfree(sci);

}