mirror of
https://github.com/torvalds/linux.git
synced 2026-11-06 21:58:01 +01:00
3e271a27c4
Without this fix, release_inode() (task 1) can race with a umount
operation in hook_sb_delete() (task 2). The order of operations in
which the race occurs is:
* task 2: hook_sb_delete() arrives at the end of the function, waiting
for landlock_superblock(sb)->inode_refs to become zero.
* task 1: release_inode(): does atomic_long_dec_and_test(), decrementing
inode_refs to zero.
* task 2: gets woken up through some other means, sees that inode_refs
is zero and returns. The caller is the unmount operation and proceeds
to release the superblock.
* task 1: Runs wake_up_var(&landlock_superblock(sb)->inode_refs),
*dereferencing the sb_security on the freed-up superblock*.
Notably, wake_up_var() does not dereference the pointer passed to it,
and only uses it to determine an overapproximated set of tasks to wake
up. So while it's potentially possible for an attacker to provide a
different value for that pointer, this only results in the wrong set of
tasks getting woken up, and in this scenario, no further tasks are
actually waiting.
Nevertheless, KASAN detects it as a slab-use-after-free read on
sb->s_security:
BUG: KASAN: slab-use-after-free in release_inode+0x196/0x290
Read of size 8 at addr ffff888103b6c0a8 by task repro/217
release_inode+0x196/0x290
landlock_put_object+0x71/0x90
landlock_free_rules+0x38/0xc0
landlock_put_ruleset+0x47/0x130
fop_ruleset_release+0x33/0x40
__fput+0x305/0x780
Freed by task 54:
kfree+0x11c/0x390
process_scheduled_works+0x766/0xe50
worker_thread+0x7bc/0xb20
The fix is to determine &landlock_superblock(inode->i_sb)->inode_refs only once
earlier in release_inode(), and later use that precalculated address for the
wake_up_var() call, without having to dereference through the superblock.
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| errata | ||
| .kunitconfig | ||
| access.h | ||
| audit.c | ||
| audit.h | ||
| cap.c | ||
| cap.h | ||
| common.h | ||
| cred.c | ||
| cred.h | ||
| domain.c | ||
| domain.h | ||
| errata.h | ||
| fs.c | ||
| fs.h | ||
| id.c | ||
| id.h | ||
| Kconfig | ||
| limits.h | ||
| log.c | ||
| log.h | ||
| Makefile | ||
| net.c | ||
| net.h | ||
| ns.c | ||
| ns.h | ||
| object.c | ||
| object.h | ||
| ruleset.c | ||
| ruleset.h | ||
| setup.c | ||
| setup.h | ||
| syscalls.c | ||
| task.c | ||
| task.h | ||
| trace.c | ||
| trace.h | ||
| tsync.c | ||
| tsync.h | ||