From 42038ece98275b9ef97531af8fdc52d0c46a00bb Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 9 Oct 2022 20:43:53 +0200 Subject: [PATCH] 4.14-stable patches added patches: fs-fix-uaf-gpf-bug-in-nilfs_mdt_destroy.patch --- ...fix-uaf-gpf-bug-in-nilfs_mdt_destroy.patch | 62 +++++++++++++++++++ queue-4.14/series | 1 + 2 files changed, 63 insertions(+) create mode 100644 queue-4.14/fs-fix-uaf-gpf-bug-in-nilfs_mdt_destroy.patch diff --git a/queue-4.14/fs-fix-uaf-gpf-bug-in-nilfs_mdt_destroy.patch b/queue-4.14/fs-fix-uaf-gpf-bug-in-nilfs_mdt_destroy.patch new file mode 100644 index 00000000000..7ab3cb2a449 --- /dev/null +++ b/queue-4.14/fs-fix-uaf-gpf-bug-in-nilfs_mdt_destroy.patch @@ -0,0 +1,62 @@ +From 2e488f13755ffbb60f307e991b27024716a33b29 Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Tue, 16 Aug 2022 12:08:58 +0800 +Subject: fs: fix UAF/GPF bug in nilfs_mdt_destroy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dongliang Mu + +commit 2e488f13755ffbb60f307e991b27024716a33b29 upstream. + +In alloc_inode, inode_init_always() could return -ENOMEM if +security_inode_alloc() fails, which causes inode->i_private +uninitialized. Then nilfs_is_metadata_file_inode() returns +true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), +which frees the uninitialized inode->i_private +and leads to crashes(e.g., UAF/GPF). + +Fix this by moving security_inode_alloc just prior to +this_cpu_inc(nr_inodes) + +Link: https://lkml.kernel.org/r/CAFcO6XOcf1Jj2SeGt=jJV59wmhESeSKpfR0omdFRq+J9nD1vfQ@mail.gmail.com +Reported-by: butt3rflyh4ck +Reported-by: Hao Sun +Reported-by: Jiacheng Xu +Reviewed-by: Christian Brauner (Microsoft) +Signed-off-by: Dongliang Mu +Cc: Al Viro +Cc: stable@vger.kernel.org +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman +--- + fs/inode.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -165,8 +165,6 @@ int inode_init_always(struct super_block + inode->i_wb_frn_history = 0; + #endif + +- if (security_inode_alloc(inode)) +- goto out; + spin_lock_init(&inode->i_lock); + lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key); + +@@ -194,11 +192,12 @@ int inode_init_always(struct super_block + inode->i_fsnotify_mask = 0; + #endif + inode->i_flctx = NULL; ++ ++ if (unlikely(security_inode_alloc(inode))) ++ return -ENOMEM; + this_cpu_inc(nr_inodes); + + return 0; +-out: +- return -ENOMEM; + } + EXPORT_SYMBOL(inode_init_always); + diff --git a/queue-4.14/series b/queue-4.14/series index fd195175f94..209817eedf6 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -22,3 +22,4 @@ i2c-dev-prevent-zero_size_ptr-deref-in-i2cdev_ioctl_rdwr.patch arm-fix-function-graph-tracer-and-unwinder-dependencies.patch wait_on_bit-add-an-acquire-memory-barrier.patch provide-arch_test_bit_acquire-for-architectures-that-define-test_bit.patch +fs-fix-uaf-gpf-bug-in-nilfs_mdt_destroy.patch -- 2.47.3