github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

afs: Fix premature cell exposure through /afs

Browse Source 
AFS cell records are prematurely exposured through the /afs dynamic root by
virtue of adding them immediately to the net->cells_dyn_ino IDR when the
cell is allocated rather than when it is added to the lookup tree.  This
allows a candidate record to be accessed, even if it's actually a duplicate
or not published yet.

Fix this by not adding the cell to cells_dyn_ino until it's confirmed
non-duplicate and is being published.  A flag is then used to record
whether it is added to the IDR to make removal from the IDR conditional.

Closes: https://sashiko.dev/#/patchset/20260618155141.2513212-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-20-dhowells@redhat.com
Fixes: 1d0b929fc0 ("afs: Change dynroot to create contents on demand")
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
David Howells 2026-06-22 10:08:53 +01:00 committed by Christian Brauner
parent 55e841836c
commit 26f17ce6fa
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
2 changed files with 18 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
fs/afs/cell.c
View File

@ -205,14 +205,7 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net,
cell->dns_source = vllist->source;
cell->dns_status = vllist->status;
smp_store_release(&cell->dns_lookup_count, 1); /* vs source/status */
down_write(&net->cells_lock);
ret = idr_alloc_cyclic(&net->cells_dyn_ino, cell,
2, INT_MAX / 2, GFP_KERNEL);
up_write(&net->cells_lock);
if (ret < 0)
goto error;
atomic_inc(&net->cells_outstanding);
cell->dynroot_ino = ret;
cell->debug_id = atomic_inc_return(&cell_debug_id);
trace_afs_cell(cell->debug_id, 1, 0, afs_cell_trace_alloc);
@ -306,6 +299,13 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net,
goto cell_already_exists;
}
ret = idr_alloc_cyclic(&net->cells_dyn_ino, candidate,
2, INT_MAX / 2, GFP_KERNEL);
if (ret < 0)
goto cant_alloc_ino;
candidate->dynroot_ino = ret;
set_bit(AFS_CELL_FL_HAVE_INO, &candidate->flags);
cell = candidate;
candidate = NULL;
afs_use_cell(cell, trace);
@ -380,6 +380,11 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net,
_leave(" = %p [cell]", cell);
return cell;
cant_alloc_ino:
up_write(&net->cells_lock);
afs_put_cell(candidate, afs_cell_trace_put_candidate);
goto error_noput;
cell_already_exists:
_debug("cell exists");
cell = cursor;
@ -596,9 +601,11 @@ static void afs_destroy_cell_work(struct work_struct *work)
timer_delete_sync(&cell->management_timer);
cancel_work_sync(&cell->manager);
down_write(&cell->net->cells_lock);
idr_remove(&cell->net->cells_dyn_ino, cell->dynroot_ino);
up_write(&cell->net->cells_lock);
if (test_bit(AFS_CELL_FL_HAVE_INO, &cell->flags)) {
down_write(&cell->net->cells_lock);
idr_remove(&cell->net->cells_dyn_ino, cell->dynroot_ino);
up_write(&cell->net->cells_lock);
}
call_rcu(&cell->rcu, afs_cell_destroy);
}

1
fs/afs/internal.h
View File

@ -388,6 +388,7 @@ struct afs_cell {
#define AFS_CELL_FL_NO_GC 0 /* The cell was added manually, don't auto-gc */
#define AFS_CELL_FL_DO_LOOKUP 1 /* DNS lookup requested */
#define AFS_CELL_FL_CHECK_ALIAS 2 /* Need to check for aliases */
#define AFS_CELL_FL_HAVE_INO 3 /* Have dynroot_ino */
enum afs_cell_state state;
short error;
enum dns_record_source dns_source:8; /* Latest source of data from lookup */