kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/fs/erofs
History
Chao Yu b2ee5e4d54 erofs: fix UAF issue for file-backed mounts w/ directio option 
commit 1caf50ce4a upstream.

[    9.269940][ T3222] Call trace:
[    9.269948][ T3222]  ext4_file_read_iter+0xac/0x108
[    9.269979][ T3222]  vfs_iocb_iter_read+0xac/0x198
[    9.269993][ T3222]  erofs_fileio_rq_submit+0x12c/0x180
[    9.270008][ T3222]  erofs_fileio_submit_bio+0x14/0x24
[    9.270030][ T3222]  z_erofs_runqueue+0x834/0x8ac
[    9.270054][ T3222]  z_erofs_read_folio+0x120/0x220
[    9.270083][ T3222]  filemap_read_folio+0x60/0x120
[    9.270102][ T3222]  filemap_fault+0xcac/0x1060
[    9.270119][ T3222]  do_pte_missing+0x2d8/0x1554
[    9.270131][ T3222]  handle_mm_fault+0x5ec/0x70c
[    9.270142][ T3222]  do_page_fault+0x178/0x88c
[    9.270167][ T3222]  do_translation_fault+0x38/0x54
[    9.270183][ T3222]  do_mem_abort+0x54/0xac
[    9.270208][ T3222]  el0_da+0x44/0x7c
[    9.270227][ T3222]  el0t_64_sync_handler+0x5c/0xf4
[    9.270253][ T3222]  el0t_64_sync+0x1bc/0x1c0

EROFS may encounter above panic when enabling file-backed mount w/
directio mount option, the root cause is it may suffer UAF in below
race condition:

- z_erofs_read_folio                          wq s_dio_done_wq
 - z_erofs_runqueue
  - erofs_fileio_submit_bio
   - erofs_fileio_rq_submit
    - vfs_iocb_iter_read
     - ext4_file_read_iter
      - ext4_dio_read_iter
       - iomap_dio_rw
       : bio was submitted and return -EIOCBQUEUED
                                              - dio_aio_complete_work
                                               - dio_complete
                                                - dio->iocb->ki_complete (erofs_fileio_ki_complete())
                                                 - kfree(rq)
                                                 : it frees iocb, iocb.ki_filp can be UAF in file_accessed().
       - file_accessed
       : access NULL file point

Introduce a reference count in struct erofs_fileio_rq, and initialize it
as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will
decrease reference count, the last one decreasing the reference count
to zero will free rq.

Cc: stable@kernel.org
Fixes: fb17675026 ("erofs: add file-backed mount support")
Fixes: 6422cde1b0 ("erofs: use buffered I/O for file-backed mounts by default")
Signed-off-by: Chao Yu <chao@kernel.org>
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-02-16 10:13:34 +01:00
..
compress.h erofs: enable error reporting for z_erofs_fixup_insize() 2025-11-30 23:49:32 +08:00
data.c iomap: add caller-provided callbacks for read and readahead 2025-11-05 12:57:23 +01:00
decompressor.c erofs: enable error reporting for z_erofs_fixup_insize() 2025-11-30 23:49:32 +08:00
decompressor_crypto.c erofs: enable error reporting for z_erofs_fixup_insize() 2025-11-30 23:49:32 +08:00
decompressor_deflate.c erofs: enable error reporting for z_erofs_fixup_insize() 2025-11-30 23:49:32 +08:00
decompressor_lzma.c erofs: enable error reporting for z_erofs_fixup_insize() 2025-11-30 23:49:32 +08:00
decompressor_zstd.c erofs: enable error reporting for z_erofs_fixup_insize() 2025-11-30 23:49:32 +08:00
dir.c erofs: Add support for FS_IOC_GETFSLABEL 2025-09-25 11:26:20 +08:00
erofs_fs.h erofs: switch on-disk header erofs_fs.h to MIT license 2025-12-01 15:25:43 +08:00
fileio.c erofs: fix UAF issue for file-backed mounts w/ directio option 2026-02-16 10:13:34 +01:00
fscache.c erofs: get rid of raw bi_end_io() usage 2025-11-30 23:55:13 +08:00
inode.c Coccinelle-based conversion to use ->i_state accessors 2025-10-20 20:22:26 +02:00
internal.h erofs: Add support for FS_IOC_GETFSLABEL 2025-09-25 11:26:20 +08:00
Kconfig erofs: Do not select tristate symbols from bool symbols 2025-08-11 06:02:20 +08:00
Makefile erofs: support DEFLATE decompression by using Intel QAT 2025-05-25 15:27:40 +08:00
namei.c erofs: get rid of erofs_kmap_type 2025-03-17 01:21:24 +08:00
super.c erofs: fix file-backed mounts no longer working on EROFS partitions 2026-01-10 06:39:20 -10:00
sysfs.c erofs: support to readahead dirent blocks in erofs_readdir() 2025-07-24 19:44:08 +08:00
xattr.c erofs: fix long xattr name prefix placement 2025-09-12 03:37:07 +08:00
xattr.h erofs: remove ENOATTR definition 2025-07-24 19:42:07 +08:00
zdata.c erofs: fix unexpected EIO under memory pressure 2025-12-22 00:18:53 +08:00
zmap.c erofs: consolidate z_erofs_extent_lookback() 2025-10-22 07:54:31 +08:00
zutil.c The various patchsets are summarized below. Plus of course many 2025-01-26 18:36:23 -08:00