linux/fs/nilfs2
Ryusuke Konishi 9b5a04ac3a nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
During unmount process of nilfs2, nothing holds nilfs_root structure after
nilfs2 detaches its writer in nilfs_detach_log_writer().  However, since
nilfs_evict_inode() uses nilfs_root for some cleanup operations, it may
cause use-after-free read if inodes are left in "garbage_list" and
released by nilfs_dispose_list() at the end of nilfs_detach_log_writer().

Fix this issue by modifying nilfs_evict_inode() to only clear inode
without additional metadata changes that use nilfs_root if the file system
is degraded to read-only or the writer is detached.

Link: https://lkml.kernel.org/r/20230509152956.8313-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+78d4495558999f55d1da@syzkaller.appspotmail.com
Closes: https://lkml.kernel.org/r/00000000000099e5ac05fb1c3b85@google.com
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2023-05-17 15:24:34 -07:00
..
alloc.c nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
alloc.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
bmap.c nilfs2: fix infinite loop in nilfs_mdt_get_block() 2023-05-06 10:10:07 -07:00
bmap.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
btnode.c nilfs2: replace obvious uses of b_page with b_folio 2023-01-18 17:12:41 -08:00
btnode.h fs/nilfs2: Use the enum req_op and blk_opf_t types 2022-07-14 12:14:33 -06:00
btree.c nilfs2: initialize "struct nilfs_binfo_dat"->bi_pad field 2023-04-05 18:06:23 -07:00
btree.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
cpfile.c nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
cpfile.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
dat.c nilfs2: prevent WARNING in nilfs_dat_commit_end() 2023-02-02 22:50:10 -08:00
dat.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
dir.c nilfs2: Remove check for PageError 2022-06-29 08:51:07 -04:00
direct.c nilfs2: initialize "struct nilfs_binfo_dat"->bi_pad field 2023-04-05 18:06:23 -07:00
direct.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
export.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
file.c nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
gcinode.c nilfs2: replace obvious uses of b_page with b_folio 2023-01-18 17:12:41 -08:00
ifile.c nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
ifile.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
inode.c nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() 2023-05-17 15:24:34 -07:00
ioctl.c nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() 2023-03-23 17:18:32 -07:00
Kconfig fs: build the legacy direct I/O code conditionally 2023-01-26 10:30:56 -07:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mdt.c nilfs2: replace obvious uses of b_page with b_folio 2023-01-18 17:12:41 -08:00
mdt.h nilfs2: fix lockdep warnings during disk space reclamation 2022-04-01 11:46:09 -07:00
namei.c fs: port ->rename() to pass mnt_idmap 2023-01-19 09:24:26 +01:00
nilfs.h fs: port ->permission() to pass mnt_idmap 2023-01-19 09:24:28 +01:00
page.c mm: return an ERR_PTR from __filemap_get_folio 2023-04-05 19:42:42 -07:00
page.h nilfs2: get rid of nilfs_mapping_init() 2022-04-01 11:46:09 -07:00
recovery.c fs: Remove aop flags parameter from block_write_begin() 2022-05-08 14:28:19 -04:00
segbuf.c Merge branch 'akpm' (patches from Andrew) 2022-03-22 16:11:53 -07:00
segbuf.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
segment.c nilfs2: do not write dirty data after degenerating to read-only 2023-05-06 10:10:07 -07:00
segment.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
sufile.c nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty 2022-11-22 18:50:45 -08:00
sufile.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
super.c nilfs2: fix sysfs interface lifetime 2023-04-05 18:06:24 -07:00
sysfs.c nilfs2: use default_groups in kobj_type 2021-12-29 10:53:48 +01:00
sysfs.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
the_nilfs.c nilfs2: fix sysfs interface lifetime 2023-04-05 18:06:24 -07:00
the_nilfs.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00