From: Greg Kroah-Hartman Date: Mon, 24 Jan 2022 09:47:54 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.300~94 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=773c39a87c40f382a67e486a9fc676ee5eb60b08;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: fuse-fix-bad-inode.patch fuse-fix-live-lock-in-fuse_iget.patch --- diff --git a/queue-4.9/fuse-fix-bad-inode.patch b/queue-4.9/fuse-fix-bad-inode.patch new file mode 100644 index 00000000000..12deb1a2457 --- /dev/null +++ b/queue-4.9/fuse-fix-bad-inode.patch @@ -0,0 +1,359 @@ +From 5d069dbe8aaf2a197142558b6fb2978189ba3454 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Thu, 10 Dec 2020 15:33:14 +0100 +Subject: fuse: fix bad inode + +From: Miklos Szeredi + +commit 5d069dbe8aaf2a197142558b6fb2978189ba3454 upstream. + +Jan Kara's analysis of the syzbot report (edited): + + The reproducer opens a directory on FUSE filesystem, it then attaches + dnotify mark to the open directory. After that a fuse_do_getattr() call + finds that attributes returned by the server are inconsistent, and calls + make_bad_inode() which, among other things does: + + inode->i_mode = S_IFREG; + + This then confuses dnotify which doesn't tear down its structures + properly and eventually crashes. + +Avoid calling make_bad_inode() on a live inode: switch to a private flag on +the fuse inode. Also add the test to ops which the bad_inode_ops would +have caught. + +This bug goes back to the initial merge of fuse in 2.6.14... + +Reported-by: syzbot+f427adf9324b92652ccc@syzkaller.appspotmail.com +Signed-off-by: Miklos Szeredi +Tested-by: Jan Kara +Cc: +[adjusted for missing fs/fuse/readdir.c and changes in fuse_evict_inode() in 4.14] +Signed-off-by: Samuel Mendoza-Jonas +Signed-off-by: Greg Kroah-Hartman +--- + fs/fuse/acl.c | 6 ++++++ + fs/fuse/dir.c | 37 ++++++++++++++++++++++++++++++++----- + fs/fuse/file.c | 21 +++++++++++++++------ + fs/fuse/fuse_i.h | 12 ++++++++++++ + fs/fuse/inode.c | 2 +- + fs/fuse/xattr.c | 9 +++++++++ + 6 files changed, 75 insertions(+), 12 deletions(-) + +--- a/fs/fuse/acl.c ++++ b/fs/fuse/acl.c +@@ -19,6 +19,9 @@ struct posix_acl *fuse_get_acl(struct in + void *value = NULL; + struct posix_acl *acl; + ++ if (fuse_is_bad(inode)) ++ return ERR_PTR(-EIO); ++ + if (!fc->posix_acl || fc->no_getxattr) + return NULL; + +@@ -53,6 +56,9 @@ int fuse_set_acl(struct inode *inode, st + const char *name; + int ret; + ++ if (fuse_is_bad(inode)) ++ return -EIO; ++ + if (!fc->posix_acl || fc->no_setxattr) + return -EOPNOTSUPP; + +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -187,7 +187,7 @@ static int fuse_dentry_revalidate(struct + int ret; + + inode = d_inode_rcu(entry); +- if (inode && is_bad_inode(inode)) ++ if (inode && fuse_is_bad(inode)) + goto invalid; + else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) || + (flags & LOOKUP_REVAL)) { +@@ -364,6 +364,9 @@ static struct dentry *fuse_lookup(struct + bool outarg_valid = true; + bool locked; + ++ if (fuse_is_bad(dir)) ++ return ERR_PTR(-EIO); ++ + locked = fuse_lock_inode(dir); + err = fuse_lookup_name(dir->i_sb, get_node_id(dir), &entry->d_name, + &outarg, &inode); +@@ -504,6 +507,9 @@ static int fuse_atomic_open(struct inode + struct fuse_conn *fc = get_fuse_conn(dir); + struct dentry *res = NULL; + ++ if (fuse_is_bad(dir)) ++ return -EIO; ++ + if (d_in_lookup(entry)) { + res = fuse_lookup(dir, entry, 0); + if (IS_ERR(res)) +@@ -551,6 +557,9 @@ static int create_new_entry(struct fuse_ + int err; + struct fuse_forget_link *forget; + ++ if (fuse_is_bad(dir)) ++ return -EIO; ++ + forget = fuse_alloc_forget(); + if (!forget) + return -ENOMEM; +@@ -672,6 +681,9 @@ static int fuse_unlink(struct inode *dir + struct fuse_conn *fc = get_fuse_conn(dir); + FUSE_ARGS(args); + ++ if (fuse_is_bad(dir)) ++ return -EIO; ++ + args.in.h.opcode = FUSE_UNLINK; + args.in.h.nodeid = get_node_id(dir); + args.in.numargs = 1; +@@ -708,6 +720,9 @@ static int fuse_rmdir(struct inode *dir, + struct fuse_conn *fc = get_fuse_conn(dir); + FUSE_ARGS(args); + ++ if (fuse_is_bad(dir)) ++ return -EIO; ++ + args.in.h.opcode = FUSE_RMDIR; + args.in.h.nodeid = get_node_id(dir); + args.in.numargs = 1; +@@ -786,6 +801,9 @@ static int fuse_rename2(struct inode *ol + struct fuse_conn *fc = get_fuse_conn(olddir); + int err; + ++ if (fuse_is_bad(olddir)) ++ return -EIO; ++ + if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE)) + return -EINVAL; + +@@ -921,7 +939,7 @@ static int fuse_do_getattr(struct inode + if (!err) { + if (fuse_invalid_attr(&outarg.attr) || + (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { +- make_bad_inode(inode); ++ fuse_make_bad(inode); + err = -EIO; + } else { + fuse_change_attributes(inode, &outarg.attr, +@@ -1114,6 +1132,9 @@ static int fuse_permission(struct inode + bool refreshed = false; + int err = 0; + ++ if (fuse_is_bad(inode)) ++ return -EIO; ++ + if (!fuse_allow_current_process(fc)) + return -EACCES; + +@@ -1251,7 +1272,7 @@ retry: + dput(dentry); + goto retry; + } +- if (is_bad_inode(inode)) { ++ if (fuse_is_bad(inode)) { + dput(dentry); + return -EIO; + } +@@ -1349,7 +1370,7 @@ static int fuse_readdir(struct file *fil + u64 attr_version = 0; + bool locked; + +- if (is_bad_inode(inode)) ++ if (fuse_is_bad(inode)) + return -EIO; + + req = fuse_get_req(fc, 1); +@@ -1707,7 +1728,7 @@ int fuse_do_setattr(struct dentry *dentr + + if (fuse_invalid_attr(&outarg.attr) || + (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { +- make_bad_inode(inode); ++ fuse_make_bad(inode); + err = -EIO; + goto error; + } +@@ -1763,6 +1784,9 @@ static int fuse_setattr(struct dentry *e + struct file *file = (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL; + int ret; + ++ if (fuse_is_bad(inode)) ++ return -EIO; ++ + if (!fuse_allow_current_process(get_fuse_conn(inode))) + return -EACCES; + +@@ -1821,6 +1845,9 @@ static int fuse_getattr(struct vfsmount + struct inode *inode = d_inode(entry); + struct fuse_conn *fc = get_fuse_conn(inode); + ++ if (fuse_is_bad(inode)) ++ return -EIO; ++ + if (!fuse_allow_current_process(fc)) + return -EACCES; + +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -206,6 +206,9 @@ int fuse_open_common(struct inode *inode + fc->atomic_o_trunc && + fc->writeback_cache; + ++ if (fuse_is_bad(inode)) ++ return -EIO; ++ + err = generic_file_open(inode, file); + if (err) + return err; +@@ -411,7 +414,7 @@ static int fuse_flush(struct file *file, + struct fuse_flush_in inarg; + int err; + +- if (is_bad_inode(inode)) ++ if (fuse_is_bad(inode)) + return -EIO; + + if (fc->no_flush) +@@ -459,7 +462,7 @@ int fuse_fsync_common(struct file *file, + struct fuse_fsync_in inarg; + int err; + +- if (is_bad_inode(inode)) ++ if (fuse_is_bad(inode)) + return -EIO; + + inode_lock(inode); +@@ -771,7 +774,7 @@ static int fuse_readpage(struct file *fi + int err; + + err = -EIO; +- if (is_bad_inode(inode)) ++ if (fuse_is_bad(inode)) + goto out; + + err = fuse_do_readpage(file, page); +@@ -898,7 +901,7 @@ static int fuse_readpages(struct file *f + int nr_alloc = min_t(unsigned, nr_pages, FUSE_MAX_PAGES_PER_REQ); + + err = -EIO; +- if (is_bad_inode(inode)) ++ if (fuse_is_bad(inode)) + goto out; + + data.file = file; +@@ -928,6 +931,9 @@ static ssize_t fuse_file_read_iter(struc + struct inode *inode = iocb->ki_filp->f_mapping->host; + struct fuse_conn *fc = get_fuse_conn(inode); + ++ if (fuse_is_bad(inode)) ++ return -EIO; ++ + /* + * In auto invalidate mode, always update attributes on read. + * Otherwise, only update if we attempt to read past EOF (to ensure +@@ -1180,6 +1186,9 @@ static ssize_t fuse_file_write_iter(stru + ssize_t err; + loff_t endbyte = 0; + ++ if (fuse_is_bad(inode)) ++ return -EIO; ++ + if (get_fuse_conn(inode)->writeback_cache) { + /* Update size (EOF optimization) and mode (SUID clearing) */ + err = fuse_update_attributes(mapping->host, NULL, file, NULL); +@@ -1911,7 +1920,7 @@ static int fuse_writepages(struct addres + int err; + + err = -EIO; +- if (is_bad_inode(inode)) ++ if (fuse_is_bad(inode)) + goto out; + + data.inode = inode; +@@ -2687,7 +2696,7 @@ long fuse_ioctl_common(struct file *file + if (!fuse_allow_current_process(fc)) + return -EACCES; + +- if (is_bad_inode(inode)) ++ if (fuse_is_bad(inode)) + return -EIO; + + return fuse_do_ioctl(file, cmd, arg, flags); +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -115,6 +115,8 @@ enum { + FUSE_I_INIT_RDPLUS, + /** An operation changing file size is in progress */ + FUSE_I_SIZE_UNSTABLE, ++ /* Bad inode */ ++ FUSE_I_BAD, + }; + + struct fuse_conn; +@@ -688,6 +690,16 @@ static inline u64 get_node_id(struct ino + return get_fuse_inode(inode)->nodeid; + } + ++static inline void fuse_make_bad(struct inode *inode) ++{ ++ set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state); ++} ++ ++static inline bool fuse_is_bad(struct inode *inode) ++{ ++ return unlikely(test_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state)); ++} ++ + /** Device operations */ + extern const struct file_operations fuse_dev_operations; + +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -316,7 +316,7 @@ struct inode *fuse_iget(struct super_blo + unlock_new_inode(inode); + } else if ((inode->i_mode ^ attr->mode) & S_IFMT) { + /* Inode has changed type, any I/O on the old should fail */ +- make_bad_inode(inode); ++ fuse_make_bad(inode); + iput(inode); + goto retry; + } +--- a/fs/fuse/xattr.c ++++ b/fs/fuse/xattr.c +@@ -113,6 +113,9 @@ ssize_t fuse_listxattr(struct dentry *en + struct fuse_getxattr_out outarg; + ssize_t ret; + ++ if (fuse_is_bad(inode)) ++ return -EIO; ++ + if (!fuse_allow_current_process(fc)) + return -EACCES; + +@@ -178,6 +181,9 @@ static int fuse_xattr_get(const struct x + struct dentry *dentry, struct inode *inode, + const char *name, void *value, size_t size) + { ++ if (fuse_is_bad(inode)) ++ return -EIO; ++ + return fuse_getxattr(inode, name, value, size); + } + +@@ -186,6 +192,9 @@ static int fuse_xattr_set(const struct x + const char *name, const void *value, size_t size, + int flags) + { ++ if (fuse_is_bad(inode)) ++ return -EIO; ++ + if (!value) + return fuse_removexattr(inode, name); + diff --git a/queue-4.9/fuse-fix-live-lock-in-fuse_iget.patch b/queue-4.9/fuse-fix-live-lock-in-fuse_iget.patch new file mode 100644 index 00000000000..bfffc832714 --- /dev/null +++ b/queue-4.9/fuse-fix-live-lock-in-fuse_iget.patch @@ -0,0 +1,53 @@ +From 775c5033a0d164622d9d10dd0f0a5531639ed3ed Mon Sep 17 00:00:00 2001 +From: Amir Goldstein +Date: Thu, 4 Mar 2021 11:09:12 +0200 +Subject: fuse: fix live lock in fuse_iget() + +From: Amir Goldstein + +commit 775c5033a0d164622d9d10dd0f0a5531639ed3ed upstream. + +Commit 5d069dbe8aaf ("fuse: fix bad inode") replaced make_bad_inode() +in fuse_iget() with a private implementation fuse_make_bad(). + +The private implementation fails to remove the bad inode from inode +cache, so the retry loop with iget5_locked() finds the same bad inode +and marks it bad forever. + +kmsg snip: + +[ ] rcu: INFO: rcu_sched self-detected stall on CPU +... +[ ] ? bit_wait_io+0x50/0x50 +[ ] ? fuse_init_file_inode+0x70/0x70 +[ ] ? find_inode.isra.32+0x60/0xb0 +[ ] ? fuse_init_file_inode+0x70/0x70 +[ ] ilookup5_nowait+0x65/0x90 +[ ] ? fuse_init_file_inode+0x70/0x70 +[ ] ilookup5.part.36+0x2e/0x80 +[ ] ? fuse_init_file_inode+0x70/0x70 +[ ] ? fuse_inode_eq+0x20/0x20 +[ ] iget5_locked+0x21/0x80 +[ ] ? fuse_inode_eq+0x20/0x20 +[ ] fuse_iget+0x96/0x1b0 + +Fixes: 5d069dbe8aaf ("fuse: fix bad inode") +Cc: stable@vger.kernel.org # 5.10+ +Signed-off-by: Amir Goldstein +Signed-off-by: Miklos Szeredi +Signed-off-by: Samuel Mendoza-Jonas +Signed-off-by: Greg Kroah-Hartman +--- + fs/fuse/fuse_i.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -692,6 +692,7 @@ static inline u64 get_node_id(struct ino + + static inline void fuse_make_bad(struct inode *inode) + { ++ remove_inode_hash(inode); + set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state); + } + diff --git a/queue-4.9/series b/queue-4.9/series index 602688dec7a..8db5f0306be 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -122,3 +122,5 @@ drm-etnaviv-limit-submit-sizes.patch ext4-set-csum-seed-in-tmp-inode-while-migrating-to-extents.patch ext4-fix-bug_on-in-ext4_bread-when-write-quota-data.patch ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch +fuse-fix-bad-inode.patch +fuse-fix-live-lock-in-fuse_iget.patch