afs: Fix premature cell exposure through /afs

AFS cell records are prematurely exposured through the /afs dynamic root by
virtue of adding them immediately to the net->cells_dyn_ino IDR when the
cell is allocated rather than when it is added to the lookup tree.  This
allows a candidate record to be accessed, even if it's actually a duplicate
or not published yet.

Fix this by not adding the cell to cells_dyn_ino until it's confirmed
non-duplicate and is being published.  A flag is then used to record
whether it is added to the IDR to make removal from the IDR conditional.

Closes: https://sashiko.dev/#/patchset/20260618155141.2513212-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-20-dhowells@redhat.com
Fixes: 1d0b929fc070 ("afs: Change dynroot to create contents on demand")
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

diff --git a/fs/afs/cell.c b/fs/afs/cell.c
index 9d8937ae24e219bf65820eb75f0ab8f77bd7dfa6..47a2645768d79e0fe2e91ca1525560a4e653d947 100644 (file)
--- a/fs/afs/cell.c
+++ b/fs/afs/cell.c
@@ -205,14 +205,7 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net,
        cell->dns_source = vllist->source;
        cell->dns_status = vllist->status;
        smp_store_release(&cell->dns_lookup_count, 1); /* vs source/status */
-       down_write(&net->cells_lock);
-       ret = idr_alloc_cyclic(&net->cells_dyn_ino, cell,
-                              2, INT_MAX / 2, GFP_KERNEL);
-       up_write(&net->cells_lock);
-       if (ret < 0)
-               goto error;
        atomic_inc(&net->cells_outstanding);
-       cell->dynroot_ino = ret;
        cell->debug_id = atomic_inc_return(&cell_debug_id);
 
        trace_afs_cell(cell->debug_id, 1, 0, afs_cell_trace_alloc);
@@ -306,6 +299,13 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net,
                        goto cell_already_exists;
        }
 
+       ret = idr_alloc_cyclic(&net->cells_dyn_ino, candidate,
+                              2, INT_MAX / 2, GFP_KERNEL);
+       if (ret < 0)
+               goto cant_alloc_ino;
+       candidate->dynroot_ino = ret;
+       set_bit(AFS_CELL_FL_HAVE_INO, &candidate->flags);
+
        cell = candidate;
        candidate = NULL;
        afs_use_cell(cell, trace);
@@ -380,6 +380,11 @@ no_wait:
        _leave(" = %p [cell]", cell);
        return cell;
 
+cant_alloc_ino:
+       up_write(&net->cells_lock);
+       afs_put_cell(candidate, afs_cell_trace_put_candidate);
+       goto error_noput;
+
 cell_already_exists:
        _debug("cell exists");
        cell = cursor;
@@ -596,9 +601,11 @@ static void afs_destroy_cell_work(struct work_struct *work)
        timer_delete_sync(&cell->management_timer);
        cancel_work_sync(&cell->manager);
 
-       down_write(&cell->net->cells_lock);
-       idr_remove(&cell->net->cells_dyn_ino, cell->dynroot_ino);
-       up_write(&cell->net->cells_lock);
+       if (test_bit(AFS_CELL_FL_HAVE_INO, &cell->flags)) {
+               down_write(&cell->net->cells_lock);
+               idr_remove(&cell->net->cells_dyn_ino, cell->dynroot_ino);
+               up_write(&cell->net->cells_lock);
+       }
 
        call_rcu(&cell->rcu, afs_cell_destroy);
 }

diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 785c646856d7f5eff4d513cf1b53302c5026f2af..601f01e5c15fcce3f12046382c108ae8483eb1f0 100644 (file)
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -388,6 +388,7 @@ struct afs_cell {
 #define AFS_CELL_FL_NO_GC      0               /* The cell was added manually, don't auto-gc */
 #define AFS_CELL_FL_DO_LOOKUP  1               /* DNS lookup requested */
 #define AFS_CELL_FL_CHECK_ALIAS        2               /* Need to check for aliases */
+#define AFS_CELL_FL_HAVE_INO   3               /* Have dynroot_ino */
        enum afs_cell_state     state;
        short                   error;
        enum dns_record_source  dns_source:8;   /* Latest source of data from lookup */