Ryusuke Konishi
83b16a60e4
nilfs2: fix sysfs interface lifetime ...
commit 42560f9c92cc43dce75dbf06cc0d840dced39b12 upstream.
The current nilfs2 sysfs support has issues with the timing of creation
and deletion of sysfs entries, potentially leading to null pointer
dereferences, use-after-free, and lockdep warnings.
Some of the sysfs attributes for nilfs2 per-filesystem instance refer to
metadata file "cpfile", "sufile", or "dat", but
nilfs_sysfs_create_device_group that creates those attributes is executed
before the inodes for these metadata files are loaded, and
nilfs_sysfs_delete_device_group which deletes these sysfs entries is
called after releasing their metadata file inodes.
Therefore, access to some of these sysfs attributes may occur outside of
the lifetime of these metadata files, resulting in inode NULL pointer
dereferences or use-after-free.
In addition, the call to nilfs_sysfs_create_device_group() is made during
the locking period of the semaphore "ns_sem" of nilfs object, so the
shrinker call caused by the memory allocation for the sysfs entries, may
derive lock dependencies "ns_sem" -> (shrinker) -> "locks acquired in
nilfs_evict_inode()".
Since nilfs2 may acquire "ns_sem" deep in the call stack holding other
locks via its error handler __nilfs_error(), this causes lockdep to report
circular locking. This is a false positive and no circular locking
actually occurs as no inodes exist yet when
nilfs_sysfs_create_device_group() is called. Fortunately, the lockdep
warnings can be resolved by simply moving the call to
nilfs_sysfs_create_device_group() out of "ns_sem".
This fixes these sysfs issues by revising where the device's sysfs
interface is created/deleted and keeping its lifetime within the lifetime
of the metadata files above.
Link: https://lkml.kernel.org/r/20230330205515.6167-1-konishi.ryusuke@gmail.com
Fixes: dd70edbde2syzbot+979fa7f9c0d086fdc282@syzkaller.appspotmail.com
Link: https://lkml.kernel.org/r/0000000000003414b505f7885f7e@google.com
Reported-by: syzbot+5b7d542076d9bddc3c6a@syzkaller.appspotmail.com
Link: https://lkml.kernel.org/r/0000000000006ac86605f5f44eb9@google.com
Cc: Viacheslav Dubeyko <slava@dubeyko.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-20 12:07:34 +02:00
9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"
2022-06-22 14:11:02 +02:00
affs: initialize fsdata in affs_truncate()
2023-02-06 07:52:36 +01:00
afs: Fix fileserver probe RTT handling
2022-12-08 11:23:03 +01:00
btrfs: scan device in non-exclusive mode
2023-04-05 11:16:46 +02:00
ceph: flush cap releases when the session is flushed
2023-02-22 12:50:33 +01:00
smb3: fix problem with null cifs super block with previous patch
2023-04-20 12:07:32 +02:00
coda: Avoid partial allocation of sig_inputArgs
2023-03-11 16:43:56 +01:00
configfs: fix possible memory leak in configfs_create_dir()
2023-01-18 11:41:09 +01:00
fscrypt: add fscrypt_symlink_getattr() for computing st_size
2021-09-12 08:56:38 +02:00
debugfs: fix error when writing negative value to atomic_t debugfs file
2023-01-18 11:40:56 +01:00
fsnotify: fix fsnotify hooks in pseudo filesystems
2022-02-01 17:24:34 +01:00
fs: dlm: handle -EBUSY first in lock arg validation
2022-10-26 13:22:14 +02:00
Revert "ecryptfs: replace BUG_ON with error handling code"
2021-05-26 12:05:19 +02:00
erofs: avoid consecutive detection for Highmem memory
2022-08-25 11:17:36 +02:00
ext2: Add more validity checks for inode counts
2022-08-25 11:17:28 +02:00
ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
2023-04-05 11:16:46 +02:00
fs: f2fs: initialize fsdata in pagecache_write()
2023-03-11 16:44:08 +01:00
fat: add ratelimit to fat*_ent_bread()
2022-06-14 18:11:30 +02:00
fscache: Fix cookie key hashing
2021-09-22 12:26:25 +02:00
fuse: lock inode unconditionally in fuse_fallocate()
2022-12-08 11:23:01 +01:00
gfs2: Always check inode size of inline inodes
2023-04-05 11:16:46 +02:00
hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
2023-03-11 16:43:59 +01:00
fs: hfsplus: fix UAF issue in hfsplus_put_super
2023-03-11 16:43:59 +01:00
hostfs: fix memory handling in follow_link()
2021-04-14 08:24:14 +02:00
hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()
2023-01-18 11:41:38 +01:00
iomap: iomap_write_failed fix
2022-06-14 18:11:36 +02:00
isofs: Fix out of bound access for corrupted isofs image
2021-11-12 14:43:03 +01:00
jbd2: wake up journal waiters in FIFO order, not LIFO
2022-10-26 13:22:17 +02:00
jffs2: correct logic when creating a hole in jffs2_write_begin
2023-03-22 13:28:07 +01:00
fs/jfs: fix shift exponent db_agl2size negative
2023-03-11 16:44:07 +01:00
kernfs: fix use-after-free in __kernfs_remove
2022-11-03 23:56:54 +09:00
lockd: lockd server-side shouldn't set fl_ops
2021-09-22 12:26:34 +02:00
minix: fix bug when opening a file with O_DIRECT
2022-04-15 14:18:35 +02:00
NFSv4: Fix hangs when recovering open state after a server reboot
2023-04-05 11:16:45 +02:00
NFSD: callback request does not use correct credential for AUTH_SYS
2023-04-20 12:07:33 +02:00
nilfs2: fix sysfs interface lifetime
2023-04-20 12:07:34 +02:00
fsnotify: fix wrong lockdep annotations
2022-06-14 18:11:34 +02:00
ntfs: check overflow when iterating ATTR_RECORDs
2022-11-25 17:42:22 +01:00
ocfs2: fix data corruption after failed write
2023-04-05 11:16:42 +02:00
orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()
2023-01-18 11:41:39 +01:00
ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
2023-01-18 11:41:43 +01:00
mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
2023-02-22 12:50:28 +01:00
pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES
2023-01-18 11:41:40 +01:00
qnx4: work around gcc false positive warning bug
2021-09-30 10:09:26 +02:00
ext4: fix bug_on in __es_tree_search caused by bad quota inode
2023-01-18 11:42:02 +01:00
fs: reiserfs: remove useless new_opts in reiserfs_remount
2023-02-06 07:52:43 +01:00
revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
2023-02-22 12:50:39 +01:00
sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output
2021-03-07 12:20:48 +01:00
fs: sysv: Fix sysv_nblocks() returns wrong value
2023-01-18 11:40:58 +01:00
tracefs: Only clobber mode/uid/gid on remount if asked
2022-09-20 12:28:00 +02:00
ubifs: ubifs_writepage: Mark page dirty after writing inode failed
2023-03-11 16:44:10 +01:00
udf: Fix file corruption when appending just after end of preallocated extent
2023-03-11 16:44:01 +01:00
fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY
2023-04-05 11:16:42 +02:00
xfs: sync lazy sb accounting on quiesce of read-only mounts
2023-02-22 12:50:38 +01:00
aio: fix mremap after fork null-deref
2023-02-22 12:50:35 +01:00
vfs: Check the truncate maximum size in inode_newsize_ok()
2022-08-25 11:17:21 +02:00
binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf
2023-01-18 11:41:46 +01:00
elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings
2021-10-06 15:42:35 +02:00
binfmt: Fix error return code in load_elf_fdpic_binary()
2023-01-18 11:41:46 +01:00
binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf
2023-01-18 11:41:46 +01:00
binfmt_misc: fix shift-out-of-bounds in check_special_flags
2023-01-18 11:41:33 +01:00
block: reexpand iov_iter after read/write
2021-05-22 11:38:29 +02:00
mm: fs: initialize fsdata passed to write_begin/write_end interface
2022-11-25 17:42:22 +01:00
chardev: fix error handling in cdev_device_add()
2023-01-18 11:41:25 +01:00
compat_ioctl: remove /dev/random commands
2022-06-22 14:11:03 +02:00
dax: fix cache flush on PMD-mapped pages
2022-06-14 18:11:41 +02:00
fs: direct-io: fix missing sdio->boundary
2021-04-14 08:24:11 +02:00
epoll: check for events when removing a timed out thread from the wait queue
2022-12-08 11:23:05 +01:00
exec: Force single empty string when argv is empty
2022-06-06 08:33:50 +02:00
fcntl: fix potential deadlock for &fasync_struct.fa_lock
2021-09-15 09:47:28 +02:00
fs: prevent out-of-bounds array speculation when closing a file descriptor
2023-03-17 08:32:47 +01:00
SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
2022-05-25 09:14:34 +02:00
fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages
2022-06-14 18:11:44 +02:00
memcg: charge fs_context and legacy_fs_context
2022-02-08 18:24:29 +01:00
fs: fix UAF/GPF bug in nilfs_mdt_destroy
2022-10-15 07:54:36 +02:00
cgroup1: fix leaked context root causing sporadic NULL deref in LTP
2021-07-31 08:19:37 +02:00
io_uring/af_unix: defer registered files gc to io_uring release
2022-10-26 13:22:59 +02:00
libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
2023-01-18 11:40:55 +01:00
mbcache: Avoid nesting of cache->c_list_lock under bit locks
2023-01-18 11:41:59 +01:00
mm: fs: initialize fsdata passed to write_begin/write_end interface
2022-11-25 17:42:22 +01:00
fs: warn about impending deprecation of mandatory locks
2021-08-26 08:36:22 -04:00
pipe: increase minimum default pipe size to 2 pages
2021-08-12 13:21:02 +02:00
pnode: terminate at peers of source
2023-01-18 11:41:44 +01:00
mount: fix mounting of detached mounts onto targets that reside on shared mounts
2021-03-17 17:03:33 +01:00
readdir: make sure to verify directory entry for legacy interfaces too
2021-04-21 12:56:16 +02:00
select: Fix indefinitely sleeping task in poll_schedule_timeout()
2022-01-29 10:25:11 +01:00
seq_file: disallow extremely large seq buffer allocations
2021-07-20 16:10:54 +02:00
io_uring: disable polling pollfree files
2022-09-05 10:27:47 +02:00
Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
2022-10-17 17:24:32 +02:00
stat: fix inconsistency between struct stat and struct compat_stat
2022-04-27 13:50:48 +02:00
vfs: make freeze_super abort when sync_filesystem returns error
2022-02-23 11:59:55 +01:00
userfaultfd: open userfaultfds with O_RDONLY
2022-10-26 13:22:21 +02:00
fs: don't audit the capability check in simple_xattr_list()
2023-01-18 11:40:53 +01:00
83b16a60e4