From: Greg Kroah-Hartman Date: Wed, 6 Nov 2024 07:25:20 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.19.323~32 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b5f24620a1125e15cf9e63da5587b4baf8fe90c3;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: mm-shmem-fix-data-race-in-shmem_getattr.patch --- diff --git a/queue-5.10/mm-shmem-fix-data-race-in-shmem_getattr.patch b/queue-5.10/mm-shmem-fix-data-race-in-shmem_getattr.patch new file mode 100644 index 00000000000..58ebe4049dc --- /dev/null +++ b/queue-5.10/mm-shmem-fix-data-race-in-shmem_getattr.patch @@ -0,0 +1,96 @@ +From d949d1d14fa281ace388b1de978e8f2cd52875cf Mon Sep 17 00:00:00 2001 +From: Jeongjun Park +Date: Mon, 9 Sep 2024 21:35:58 +0900 +Subject: mm: shmem: fix data-race in shmem_getattr() + +From: Jeongjun Park + +commit d949d1d14fa281ace388b1de978e8f2cd52875cf upstream. + +I got the following KCSAN report during syzbot testing: + +================================================================== +BUG: KCSAN: data-race in generic_fillattr / inode_set_ctime_current + +write to 0xffff888102eb3260 of 4 bytes by task 6565 on cpu 1: + inode_set_ctime_to_ts include/linux/fs.h:1638 [inline] + inode_set_ctime_current+0x169/0x1d0 fs/inode.c:2626 + shmem_mknod+0x117/0x180 mm/shmem.c:3443 + shmem_create+0x34/0x40 mm/shmem.c:3497 + lookup_open fs/namei.c:3578 [inline] + open_last_lookups fs/namei.c:3647 [inline] + path_openat+0xdbc/0x1f00 fs/namei.c:3883 + do_filp_open+0xf7/0x200 fs/namei.c:3913 + do_sys_openat2+0xab/0x120 fs/open.c:1416 + do_sys_open fs/open.c:1431 [inline] + __do_sys_openat fs/open.c:1447 [inline] + __se_sys_openat fs/open.c:1442 [inline] + __x64_sys_openat+0xf3/0x120 fs/open.c:1442 + x64_sys_call+0x1025/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:258 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +read to 0xffff888102eb3260 of 4 bytes by task 3498 on cpu 0: + inode_get_ctime_nsec include/linux/fs.h:1623 [inline] + inode_get_ctime include/linux/fs.h:1629 [inline] + generic_fillattr+0x1dd/0x2f0 fs/stat.c:62 + shmem_getattr+0x17b/0x200 mm/shmem.c:1157 + vfs_getattr_nosec fs/stat.c:166 [inline] + vfs_getattr+0x19b/0x1e0 fs/stat.c:207 + vfs_statx_path fs/stat.c:251 [inline] + vfs_statx+0x134/0x2f0 fs/stat.c:315 + vfs_fstatat+0xec/0x110 fs/stat.c:341 + __do_sys_newfstatat fs/stat.c:505 [inline] + __se_sys_newfstatat+0x58/0x260 fs/stat.c:499 + __x64_sys_newfstatat+0x55/0x70 fs/stat.c:499 + x64_sys_call+0x141f/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:263 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +value changed: 0x2755ae53 -> 0x27ee44d3 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 0 UID: 0 PID: 3498 Comm: udevd Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 +================================================================== + +When calling generic_fillattr(), if you don't hold read lock, data-race +will occur in inode member variables, which can cause unexpected +behavior. + +Since there is no special protection when shmem_getattr() calls +generic_fillattr(), data-race occurs by functions such as shmem_unlink() +or shmem_mknod(). This can cause unexpected results, so commenting it out +is not enough. + +Therefore, when calling generic_fillattr() from shmem_getattr(), it is +appropriate to protect the inode using inode_lock_shared() and +inode_unlock_shared() to prevent data-race. + +Link: https://lkml.kernel.org/r/20240909123558.70229-1-aha310510@gmail.com +Fixes: 44a30220bc0a ("shmem: recalculate file inode when fstat") +Signed-off-by: Jeongjun Park +Reported-by: syzbot +Cc: Hugh Dickins +Cc: Yu Zhao +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/shmem.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -1077,7 +1077,9 @@ static int shmem_getattr(const struct pa + shmem_recalc_inode(inode); + spin_unlock_irq(&info->lock); + } ++ inode_lock_shared(inode); + generic_fillattr(inode, stat); ++ inode_unlock_shared(inode); + + if (is_huge_enabled(sb_info)) + stat->blksize = HPAGE_PMD_SIZE; diff --git a/queue-5.10/series b/queue-5.10/series index 0c0c8ce2a0b..83e7799298b 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -103,3 +103,4 @@ riscv-remove-duplicated-get_rm.patch ocfs2-pass-u64-to-ocfs2_truncate_inline-maybe-overfl.patch x86-bugs-use-code-segment-selector-for-verw-operand.patch nilfs2-fix-kernel-bug-due-to-missing-clearing-of-checked-flag.patch +mm-shmem-fix-data-race-in-shmem_getattr.patch