Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 732251ca authored by Miklos Szeredi's avatar Miklos Szeredi Committed by Greg Kroah-Hartman
Browse files

fuse: fix bad inode 



[ Upstream commit 5d069dbe8aaf2a197142558b6fb2978189ba3454 ]

Jan Kara's analysis of the syzbot report (edited):

  The reproducer opens a directory on FUSE filesystem, it then attaches
  dnotify mark to the open directory.  After that a fuse_do_getattr() call
  finds that attributes returned by the server are inconsistent, and calls
  make_bad_inode() which, among other things does:

          inode->i_mode = S_IFREG;

  This then confuses dnotify which doesn't tear down its structures
  properly and eventually crashes.

Avoid calling make_bad_inode() on a live inode: switch to a private flag on
the fuse inode.  Also add the test to ops which the bad_inode_ops would
have caught.

This bug goes back to the initial merge of fuse in 2.6.14...

Reported-by: default avatar <syzbot+f427adf9324b92652ccc@syzkaller.appspotmail.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
Tested-by: default avatarJan Kara <jack@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 06c672dd

fs/fuse/acl.c

+6 −0
Original line number Diff line number Diff line
@@ -19,6 +19,9 @@ struct posix_acl *fuse_get_acl(struct inode *inode, int type) 
	void *value = NULL;

	struct posix_acl *acl;



	if (fuse_is_bad(inode))

		return ERR_PTR(-EIO);



	if (!fc->posix_acl || fc->no_getxattr)

		return NULL;
@@ -53,6 +56,9 @@ int fuse_set_acl(struct inode *inode, struct posix_acl *acl, int type) 
	const char *name;

	int ret;



	if (fuse_is_bad(inode))

		return -EIO;



	if (!fc->posix_acl || fc->no_setxattr)

		return -EOPNOTSUPP;

fs/fuse/dir.c

+32 −5
Original line number Diff line number Diff line
@@ -201,7 +201,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags) 
	int ret;



	inode = d_inode_rcu(entry);

	if (inode && is_bad_inode(inode))

	if (inode && fuse_is_bad(inode))

		goto invalid;

	else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) ||

		 (flags & LOOKUP_REVAL)) {
@@ -386,6 +386,9 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry, 
	bool outarg_valid = true;

	bool locked;



	if (fuse_is_bad(dir))

		return ERR_PTR(-EIO);



	locked = fuse_lock_inode(dir);

	err = fuse_lookup_name(dir->i_sb, get_node_id(dir), &entry->d_name,

			       &outarg, &inode);
@@ -529,6 +532,9 @@ static int fuse_atomic_open(struct inode *dir, struct dentry *entry, 
	struct fuse_conn *fc = get_fuse_conn(dir);

	struct dentry *res = NULL;



	if (fuse_is_bad(dir))

		return -EIO;



	if (d_in_lookup(entry)) {

		res = fuse_lookup(dir, entry, 0);

		if (IS_ERR(res))
@@ -577,6 +583,9 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_args *args, 
	int err;

	struct fuse_forget_link *forget;



	if (fuse_is_bad(dir))

		return -EIO;



	forget = fuse_alloc_forget();

	if (!forget)

		return -ENOMEM;
@@ -704,6 +713,9 @@ static int fuse_unlink(struct inode *dir, struct dentry *entry) 
	struct fuse_conn *fc = get_fuse_conn(dir);

	FUSE_ARGS(args);



	if (fuse_is_bad(dir))

		return -EIO;



	args.opcode = FUSE_UNLINK;

	args.nodeid = get_node_id(dir);

	args.in_numargs = 1;
@@ -740,6 +752,9 @@ static int fuse_rmdir(struct inode *dir, struct dentry *entry) 
	struct fuse_conn *fc = get_fuse_conn(dir);

	FUSE_ARGS(args);



	if (fuse_is_bad(dir))

		return -EIO;



	args.opcode = FUSE_RMDIR;

	args.nodeid = get_node_id(dir);

	args.in_numargs = 1;
@@ -818,6 +833,9 @@ static int fuse_rename2(struct inode *olddir, struct dentry *oldent, 
	struct fuse_conn *fc = get_fuse_conn(olddir);

	int err;



	if (fuse_is_bad(olddir))

		return -EIO;



	if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE))

		return -EINVAL;
@@ -953,7 +971,7 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat, 
	if (!err) {

		if (fuse_invalid_attr(&outarg.attr) ||

		    (inode->i_mode ^ outarg.attr.mode) & S_IFMT) {

			make_bad_inode(inode);

			fuse_make_bad(inode);

			err = -EIO;

		} else {

			fuse_change_attributes(inode, &outarg.attr,
@@ -1155,6 +1173,9 @@ static int fuse_permission(struct inode *inode, int mask) 
	bool refreshed = false;

	int err = 0;



	if (fuse_is_bad(inode))

		return -EIO;



	if (!fuse_allow_current_process(fc))

		return -EACCES;
@@ -1250,7 +1271,7 @@ static const char *fuse_get_link(struct dentry *dentry, struct inode *inode, 
	int err;



	err = -EIO;

	if (is_bad_inode(inode))

	if (fuse_is_bad(inode))

		goto out_err;



	if (fc->cache_symlinks)
@@ -1298,7 +1319,7 @@ static int fuse_dir_fsync(struct file *file, loff_t start, loff_t end, 
	struct fuse_conn *fc = get_fuse_conn(inode);

	int err;



	if (is_bad_inode(inode))

	if (fuse_is_bad(inode))

		return -EIO;



	if (fc->no_fsyncdir)
@@ -1575,7 +1596,7 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, 


	if (fuse_invalid_attr(&outarg.attr) ||

	    (inode->i_mode ^ outarg.attr.mode) & S_IFMT) {

		make_bad_inode(inode);

		fuse_make_bad(inode);

		err = -EIO;

		goto error;

	}
@@ -1631,6 +1652,9 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr) 
	struct file *file = (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL;

	int ret;



	if (fuse_is_bad(inode))

		return -EIO;



	if (!fuse_allow_current_process(get_fuse_conn(inode)))

		return -EACCES;
@@ -1689,6 +1713,9 @@ static int fuse_getattr(const struct path *path, struct kstat *stat, 
	struct inode *inode = d_inode(path->dentry);

	struct fuse_conn *fc = get_fuse_conn(inode);



	if (fuse_is_bad(inode))

		return -EIO;



	if (!fuse_allow_current_process(fc))

		return -EACCES;

fs/fuse/file.c

+11 −8
Original line number Diff line number Diff line
@@ -222,6 +222,9 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir) 
			  fc->atomic_o_trunc &&

			  fc->writeback_cache;



	if (fuse_is_bad(inode))

		return -EIO;



	err = generic_file_open(inode, file);

	if (err)

		return err;
@@ -443,7 +446,7 @@ static int fuse_flush(struct file *file, fl_owner_t id) 
	FUSE_ARGS(args);

	int err;



	if (is_bad_inode(inode))

	if (fuse_is_bad(inode))

		return -EIO;



	if (fc->no_flush)
@@ -506,7 +509,7 @@ static int fuse_fsync(struct file *file, loff_t start, loff_t end, 
	struct fuse_conn *fc = get_fuse_conn(inode);

	int err;



	if (is_bad_inode(inode))

	if (fuse_is_bad(inode))

		return -EIO;



	inode_lock(inode);
@@ -830,7 +833,7 @@ static int fuse_readpage(struct file *file, struct page *page) 
	int err;



	err = -EIO;

	if (is_bad_inode(inode))

	if (fuse_is_bad(inode))

		goto out;



	err = fuse_do_readpage(file, page);
@@ -973,7 +976,7 @@ static int fuse_readpages(struct file *file, struct address_space *mapping, 
	int err;



	err = -EIO;

	if (is_bad_inode(inode))

	if (fuse_is_bad(inode))

		goto out;



	data.file = file;
@@ -1569,7 +1572,7 @@ static ssize_t fuse_file_read_iter(struct kiocb *iocb, struct iov_iter *to) 
	struct file *file = iocb->ki_filp;

	struct fuse_file *ff = file->private_data;



	if (is_bad_inode(file_inode(file)))

	if (fuse_is_bad(file_inode(file)))

		return -EIO;



	if (!(ff->open_flags & FOPEN_DIRECT_IO))
@@ -1583,7 +1586,7 @@ static ssize_t fuse_file_write_iter(struct kiocb *iocb, struct iov_iter *from) 
	struct file *file = iocb->ki_filp;

	struct fuse_file *ff = file->private_data;



	if (is_bad_inode(file_inode(file)))

	if (fuse_is_bad(file_inode(file)))

		return -EIO;



	if (!(ff->open_flags & FOPEN_DIRECT_IO))
@@ -2133,7 +2136,7 @@ static int fuse_writepages(struct address_space *mapping, 
	int err;



	err = -EIO;

	if (is_bad_inode(inode))

	if (fuse_is_bad(inode))

		goto out;



	data.inode = inode;
@@ -2911,7 +2914,7 @@ long fuse_ioctl_common(struct file *file, unsigned int cmd, 
	if (!fuse_allow_current_process(fc))

		return -EACCES;



	if (is_bad_inode(inode))

	if (fuse_is_bad(inode))

		return -EIO;



	return fuse_do_ioctl(file, cmd, arg, flags);

fs/fuse/fuse_i.h

+12 −0
Original line number Diff line number Diff line
@@ -158,6 +158,8 @@ enum { 
	FUSE_I_INIT_RDPLUS,

	/** An operation changing file size is in progress  */

	FUSE_I_SIZE_UNSTABLE,

	/* Bad inode */

	FUSE_I_BAD,

};



struct fuse_conn;
@@ -787,6 +789,16 @@ static inline u64 fuse_get_attr_version(struct fuse_conn *fc) 
	return atomic64_read(&fc->attr_version);

}



static inline void fuse_make_bad(struct inode *inode)

{

	set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state);

}



static inline bool fuse_is_bad(struct inode *inode)

{

	return unlikely(test_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state));

}



/** Device operations */

extern const struct file_operations fuse_dev_operations;

fs/fuse/inode.c

+2 −2
Original line number Diff line number Diff line
@@ -115,7 +115,7 @@ static void fuse_evict_inode(struct inode *inode) 
		fuse_queue_forget(fc, fi->forget, fi->nodeid, fi->nlookup);

		fi->forget = NULL;

	}

	if (S_ISREG(inode->i_mode) && !is_bad_inode(inode)) {

	if (S_ISREG(inode->i_mode) && !fuse_is_bad(inode)) {

		WARN_ON(!list_empty(&fi->write_files));

		WARN_ON(!list_empty(&fi->queued_writes));

	}
@@ -306,7 +306,7 @@ struct inode *fuse_iget(struct super_block *sb, u64 nodeid, 
		unlock_new_inode(inode);

	} else if ((inode->i_mode ^ attr->mode) & S_IFMT) {

		/* Inode has changed type, any I/O on the old should fail */

		make_bad_inode(inode);

		fuse_make_bad(inode);

		iput(inode);

		goto retry;

	}