forked from mirrors/linux
		
	 5d8f805789
			
		
	
	
		5d8f805789
		
	
	
	
	
		
			
			We got the following issue in our fault injection stress test:
==================================================================
BUG: KASAN: slab-use-after-free in cachefiles_withdraw_cookie+0x4d9/0x600
Read of size 8 at addr ffff888118efc000 by task kworker/u78:0/109
CPU: 13 PID: 109 Comm: kworker/u78:0 Not tainted 6.8.0-dirty #566
Call Trace:
 <TASK>
 kasan_report+0x93/0xc0
 cachefiles_withdraw_cookie+0x4d9/0x600
 fscache_cookie_state_machine+0x5c8/0x1230
 fscache_cookie_worker+0x91/0x1c0
 process_one_work+0x7fa/0x1800
 [...]
Allocated by task 117:
 kmalloc_trace+0x1b3/0x3c0
 cachefiles_acquire_volume+0xf3/0x9c0
 fscache_create_volume_work+0x97/0x150
 process_one_work+0x7fa/0x1800
 [...]
Freed by task 120301:
 kfree+0xf1/0x2c0
 cachefiles_withdraw_cache+0x3fa/0x920
 cachefiles_put_unbind_pincount+0x1f6/0x250
 cachefiles_daemon_release+0x13b/0x290
 __fput+0x204/0xa00
 task_work_run+0x139/0x230
 do_exit+0x87a/0x29b0
 [...]
==================================================================
Following is the process that triggers the issue:
           p1                |             p2
------------------------------------------------------------
                              fscache_begin_lookup
                               fscache_begin_volume_access
                                fscache_cache_is_live(fscache_cache)
cachefiles_daemon_release
 cachefiles_put_unbind_pincount
  cachefiles_daemon_unbind
   cachefiles_withdraw_cache
    fscache_withdraw_cache
     fscache_set_cache_state(cache, FSCACHE_CACHE_IS_WITHDRAWN);
    cachefiles_withdraw_objects(cache)
    fscache_wait_for_objects(fscache)
      atomic_read(&fscache_cache->object_count) == 0
                              fscache_perform_lookup
                               cachefiles_lookup_cookie
                                cachefiles_alloc_object
                                 refcount_set(&object->ref, 1);
                                 object->volume = volume
                                 fscache_count_object(vcookie->cache);
                                  atomic_inc(&fscache_cache->object_count)
    cachefiles_withdraw_volumes
     cachefiles_withdraw_volume
      fscache_withdraw_volume
      __cachefiles_free_volume
       kfree(cachefiles_volume)
                              fscache_cookie_state_machine
                               cachefiles_withdraw_cookie
                                cache = object->volume->cache;
                                // cachefiles_volume UAF !!!
After setting FSCACHE_CACHE_IS_WITHDRAWN, wait for all the cookie lookups
to complete first, and then wait for fscache_cache->object_count == 0 to
avoid the cookie exiting after the volume has been freed and triggering
the above issue. Therefore call fscache_withdraw_volume() before calling
cachefiles_withdraw_objects().
This way, after setting FSCACHE_CACHE_IS_WITHDRAWN, only the following two
cases will occur:
1) fscache_begin_lookup fails in fscache_begin_volume_access().
2) fscache_withdraw_volume() will ensure that fscache_count_object() has
   been executed before calling fscache_wait_for_objects().
Fixes: fe2140e2f5 ("cachefiles: Implement volume support")
Suggested-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Link: https://lore.kernel.org/r/20240628062930.2467993-4-libaokun@huaweicloud.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
		
	
			
		
			
				
	
	
		
			428 lines
		
	
	
	
		
			11 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			428 lines
		
	
	
	
		
			11 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
| // SPDX-License-Identifier: GPL-2.0-or-later
 | |
| /* Manage high-level VFS aspects of a cache.
 | |
|  *
 | |
|  * Copyright (C) 2007, 2021 Red Hat, Inc. All Rights Reserved.
 | |
|  * Written by David Howells (dhowells@redhat.com)
 | |
|  */
 | |
| 
 | |
| #include <linux/slab.h>
 | |
| #include <linux/statfs.h>
 | |
| #include <linux/namei.h>
 | |
| #include <trace/events/fscache.h>
 | |
| #include "internal.h"
 | |
| 
 | |
| /*
 | |
|  * Bring a cache online.
 | |
|  */
 | |
| int cachefiles_add_cache(struct cachefiles_cache *cache)
 | |
| {
 | |
| 	struct fscache_cache *cache_cookie;
 | |
| 	struct path path;
 | |
| 	struct kstatfs stats;
 | |
| 	struct dentry *graveyard, *cachedir, *root;
 | |
| 	const struct cred *saved_cred;
 | |
| 	int ret;
 | |
| 
 | |
| 	_enter("");
 | |
| 
 | |
| 	cache_cookie = fscache_acquire_cache(cache->tag);
 | |
| 	if (IS_ERR(cache_cookie))
 | |
| 		return PTR_ERR(cache_cookie);
 | |
| 
 | |
| 	/* we want to work under the module's security ID */
 | |
| 	ret = cachefiles_get_security_ID(cache);
 | |
| 	if (ret < 0)
 | |
| 		goto error_getsec;
 | |
| 
 | |
| 	cachefiles_begin_secure(cache, &saved_cred);
 | |
| 
 | |
| 	/* look up the directory at the root of the cache */
 | |
| 	ret = kern_path(cache->rootdirname, LOOKUP_DIRECTORY, &path);
 | |
| 	if (ret < 0)
 | |
| 		goto error_open_root;
 | |
| 
 | |
| 	cache->mnt = path.mnt;
 | |
| 	root = path.dentry;
 | |
| 
 | |
| 	ret = -EINVAL;
 | |
| 	if (is_idmapped_mnt(path.mnt)) {
 | |
| 		pr_warn("File cache on idmapped mounts not supported");
 | |
| 		goto error_unsupported;
 | |
| 	}
 | |
| 
 | |
| 	/* Check features of the backing filesystem:
 | |
| 	 * - Directories must support looking up and directory creation
 | |
| 	 * - We create tmpfiles to handle invalidation
 | |
| 	 * - We use xattrs to store metadata
 | |
| 	 * - We need to be able to query the amount of space available
 | |
| 	 * - We want to be able to sync the filesystem when stopping the cache
 | |
| 	 * - We use DIO to/from pages, so the blocksize mustn't be too big.
 | |
| 	 */
 | |
| 	ret = -EOPNOTSUPP;
 | |
| 	if (d_is_negative(root) ||
 | |
| 	    !d_backing_inode(root)->i_op->lookup ||
 | |
| 	    !d_backing_inode(root)->i_op->mkdir ||
 | |
| 	    !d_backing_inode(root)->i_op->tmpfile ||
 | |
| 	    !(d_backing_inode(root)->i_opflags & IOP_XATTR) ||
 | |
| 	    !root->d_sb->s_op->statfs ||
 | |
| 	    !root->d_sb->s_op->sync_fs ||
 | |
| 	    root->d_sb->s_blocksize > PAGE_SIZE)
 | |
| 		goto error_unsupported;
 | |
| 
 | |
| 	ret = -EROFS;
 | |
| 	if (sb_rdonly(root->d_sb))
 | |
| 		goto error_unsupported;
 | |
| 
 | |
| 	/* determine the security of the on-disk cache as this governs
 | |
| 	 * security ID of files we create */
 | |
| 	ret = cachefiles_determine_cache_security(cache, root, &saved_cred);
 | |
| 	if (ret < 0)
 | |
| 		goto error_unsupported;
 | |
| 
 | |
| 	/* get the cache size and blocksize */
 | |
| 	ret = vfs_statfs(&path, &stats);
 | |
| 	if (ret < 0)
 | |
| 		goto error_unsupported;
 | |
| 
 | |
| 	ret = -ERANGE;
 | |
| 	if (stats.f_bsize <= 0)
 | |
| 		goto error_unsupported;
 | |
| 
 | |
| 	ret = -EOPNOTSUPP;
 | |
| 	if (stats.f_bsize > PAGE_SIZE)
 | |
| 		goto error_unsupported;
 | |
| 
 | |
| 	cache->bsize = stats.f_bsize;
 | |
| 	cache->bshift = ilog2(stats.f_bsize);
 | |
| 
 | |
| 	_debug("blksize %u (shift %u)",
 | |
| 	       cache->bsize, cache->bshift);
 | |
| 
 | |
| 	_debug("size %llu, avail %llu",
 | |
| 	       (unsigned long long) stats.f_blocks,
 | |
| 	       (unsigned long long) stats.f_bavail);
 | |
| 
 | |
| 	/* set up caching limits */
 | |
| 	do_div(stats.f_files, 100);
 | |
| 	cache->fstop = stats.f_files * cache->fstop_percent;
 | |
| 	cache->fcull = stats.f_files * cache->fcull_percent;
 | |
| 	cache->frun  = stats.f_files * cache->frun_percent;
 | |
| 
 | |
| 	_debug("limits {%llu,%llu,%llu} files",
 | |
| 	       (unsigned long long) cache->frun,
 | |
| 	       (unsigned long long) cache->fcull,
 | |
| 	       (unsigned long long) cache->fstop);
 | |
| 
 | |
| 	do_div(stats.f_blocks, 100);
 | |
| 	cache->bstop = stats.f_blocks * cache->bstop_percent;
 | |
| 	cache->bcull = stats.f_blocks * cache->bcull_percent;
 | |
| 	cache->brun  = stats.f_blocks * cache->brun_percent;
 | |
| 
 | |
| 	_debug("limits {%llu,%llu,%llu} blocks",
 | |
| 	       (unsigned long long) cache->brun,
 | |
| 	       (unsigned long long) cache->bcull,
 | |
| 	       (unsigned long long) cache->bstop);
 | |
| 
 | |
| 	/* get the cache directory and check its type */
 | |
| 	cachedir = cachefiles_get_directory(cache, root, "cache", NULL);
 | |
| 	if (IS_ERR(cachedir)) {
 | |
| 		ret = PTR_ERR(cachedir);
 | |
| 		goto error_unsupported;
 | |
| 	}
 | |
| 
 | |
| 	cache->store = cachedir;
 | |
| 
 | |
| 	/* get the graveyard directory */
 | |
| 	graveyard = cachefiles_get_directory(cache, root, "graveyard", NULL);
 | |
| 	if (IS_ERR(graveyard)) {
 | |
| 		ret = PTR_ERR(graveyard);
 | |
| 		goto error_unsupported;
 | |
| 	}
 | |
| 
 | |
| 	cache->graveyard = graveyard;
 | |
| 	cache->cache = cache_cookie;
 | |
| 
 | |
| 	ret = fscache_add_cache(cache_cookie, &cachefiles_cache_ops, cache);
 | |
| 	if (ret < 0)
 | |
| 		goto error_add_cache;
 | |
| 
 | |
| 	/* done */
 | |
| 	set_bit(CACHEFILES_READY, &cache->flags);
 | |
| 	dput(root);
 | |
| 
 | |
| 	pr_info("File cache on %s registered\n", cache_cookie->name);
 | |
| 
 | |
| 	/* check how much space the cache has */
 | |
| 	cachefiles_has_space(cache, 0, 0, cachefiles_has_space_check);
 | |
| 	cachefiles_end_secure(cache, saved_cred);
 | |
| 	_leave(" = 0 [%px]", cache->cache);
 | |
| 	return 0;
 | |
| 
 | |
| error_add_cache:
 | |
| 	cachefiles_put_directory(cache->graveyard);
 | |
| 	cache->graveyard = NULL;
 | |
| error_unsupported:
 | |
| 	cachefiles_put_directory(cache->store);
 | |
| 	cache->store = NULL;
 | |
| 	mntput(cache->mnt);
 | |
| 	cache->mnt = NULL;
 | |
| 	dput(root);
 | |
| error_open_root:
 | |
| 	cachefiles_end_secure(cache, saved_cred);
 | |
| 	put_cred(cache->cache_cred);
 | |
| 	cache->cache_cred = NULL;
 | |
| error_getsec:
 | |
| 	fscache_relinquish_cache(cache_cookie);
 | |
| 	cache->cache = NULL;
 | |
| 	pr_err("Failed to register: %d\n", ret);
 | |
| 	return ret;
 | |
| }
 | |
| 
 | |
| /*
 | |
|  * See if we have space for a number of pages and/or a number of files in the
 | |
|  * cache
 | |
|  */
 | |
| int cachefiles_has_space(struct cachefiles_cache *cache,
 | |
| 			 unsigned fnr, unsigned bnr,
 | |
| 			 enum cachefiles_has_space_for reason)
 | |
| {
 | |
| 	struct kstatfs stats;
 | |
| 	u64 b_avail, b_writing;
 | |
| 	int ret;
 | |
| 
 | |
| 	struct path path = {
 | |
| 		.mnt	= cache->mnt,
 | |
| 		.dentry	= cache->mnt->mnt_root,
 | |
| 	};
 | |
| 
 | |
| 	//_enter("{%llu,%llu,%llu,%llu,%llu,%llu},%u,%u",
 | |
| 	//       (unsigned long long) cache->frun,
 | |
| 	//       (unsigned long long) cache->fcull,
 | |
| 	//       (unsigned long long) cache->fstop,
 | |
| 	//       (unsigned long long) cache->brun,
 | |
| 	//       (unsigned long long) cache->bcull,
 | |
| 	//       (unsigned long long) cache->bstop,
 | |
| 	//       fnr, bnr);
 | |
| 
 | |
| 	/* find out how many pages of blockdev are available */
 | |
| 	memset(&stats, 0, sizeof(stats));
 | |
| 
 | |
| 	ret = vfs_statfs(&path, &stats);
 | |
| 	if (ret < 0) {
 | |
| 		trace_cachefiles_vfs_error(NULL, d_inode(path.dentry), ret,
 | |
| 					   cachefiles_trace_statfs_error);
 | |
| 		if (ret == -EIO)
 | |
| 			cachefiles_io_error(cache, "statfs failed");
 | |
| 		_leave(" = %d", ret);
 | |
| 		return ret;
 | |
| 	}
 | |
| 
 | |
| 	b_avail = stats.f_bavail;
 | |
| 	b_writing = atomic_long_read(&cache->b_writing);
 | |
| 	if (b_avail > b_writing)
 | |
| 		b_avail -= b_writing;
 | |
| 	else
 | |
| 		b_avail = 0;
 | |
| 
 | |
| 	//_debug("avail %llu,%llu",
 | |
| 	//       (unsigned long long)stats.f_ffree,
 | |
| 	//       (unsigned long long)b_avail);
 | |
| 
 | |
| 	/* see if there is sufficient space */
 | |
| 	if (stats.f_ffree > fnr)
 | |
| 		stats.f_ffree -= fnr;
 | |
| 	else
 | |
| 		stats.f_ffree = 0;
 | |
| 
 | |
| 	if (b_avail > bnr)
 | |
| 		b_avail -= bnr;
 | |
| 	else
 | |
| 		b_avail = 0;
 | |
| 
 | |
| 	ret = -ENOBUFS;
 | |
| 	if (stats.f_ffree < cache->fstop ||
 | |
| 	    b_avail < cache->bstop)
 | |
| 		goto stop_and_begin_cull;
 | |
| 
 | |
| 	ret = 0;
 | |
| 	if (stats.f_ffree < cache->fcull ||
 | |
| 	    b_avail < cache->bcull)
 | |
| 		goto begin_cull;
 | |
| 
 | |
| 	if (test_bit(CACHEFILES_CULLING, &cache->flags) &&
 | |
| 	    stats.f_ffree >= cache->frun &&
 | |
| 	    b_avail >= cache->brun &&
 | |
| 	    test_and_clear_bit(CACHEFILES_CULLING, &cache->flags)
 | |
| 	    ) {
 | |
| 		_debug("cease culling");
 | |
| 		cachefiles_state_changed(cache);
 | |
| 	}
 | |
| 
 | |
| 	//_leave(" = 0");
 | |
| 	return 0;
 | |
| 
 | |
| stop_and_begin_cull:
 | |
| 	switch (reason) {
 | |
| 	case cachefiles_has_space_for_write:
 | |
| 		fscache_count_no_write_space();
 | |
| 		break;
 | |
| 	case cachefiles_has_space_for_create:
 | |
| 		fscache_count_no_create_space();
 | |
| 		break;
 | |
| 	default:
 | |
| 		break;
 | |
| 	}
 | |
| begin_cull:
 | |
| 	if (!test_and_set_bit(CACHEFILES_CULLING, &cache->flags)) {
 | |
| 		_debug("### CULL CACHE ###");
 | |
| 		cachefiles_state_changed(cache);
 | |
| 	}
 | |
| 
 | |
| 	_leave(" = %d", ret);
 | |
| 	return ret;
 | |
| }
 | |
| 
 | |
| /*
 | |
|  * Mark all the objects as being out of service and queue them all for cleanup.
 | |
|  */
 | |
| static void cachefiles_withdraw_objects(struct cachefiles_cache *cache)
 | |
| {
 | |
| 	struct cachefiles_object *object;
 | |
| 	unsigned int count = 0;
 | |
| 
 | |
| 	_enter("");
 | |
| 
 | |
| 	spin_lock(&cache->object_list_lock);
 | |
| 
 | |
| 	while (!list_empty(&cache->object_list)) {
 | |
| 		object = list_first_entry(&cache->object_list,
 | |
| 					  struct cachefiles_object, cache_link);
 | |
| 		cachefiles_see_object(object, cachefiles_obj_see_withdrawal);
 | |
| 		list_del_init(&object->cache_link);
 | |
| 		fscache_withdraw_cookie(object->cookie);
 | |
| 		count++;
 | |
| 		if ((count & 63) == 0) {
 | |
| 			spin_unlock(&cache->object_list_lock);
 | |
| 			cond_resched();
 | |
| 			spin_lock(&cache->object_list_lock);
 | |
| 		}
 | |
| 	}
 | |
| 
 | |
| 	spin_unlock(&cache->object_list_lock);
 | |
| 	_leave(" [%u objs]", count);
 | |
| }
 | |
| 
 | |
| /*
 | |
|  * Withdraw fscache volumes.
 | |
|  */
 | |
| static void cachefiles_withdraw_fscache_volumes(struct cachefiles_cache *cache)
 | |
| {
 | |
| 	struct list_head *cur;
 | |
| 	struct cachefiles_volume *volume;
 | |
| 	struct fscache_volume *vcookie;
 | |
| 
 | |
| 	_enter("");
 | |
| retry:
 | |
| 	spin_lock(&cache->object_list_lock);
 | |
| 	list_for_each(cur, &cache->volumes) {
 | |
| 		volume = list_entry(cur, struct cachefiles_volume, cache_link);
 | |
| 
 | |
| 		if (atomic_read(&volume->vcookie->n_accesses) == 0)
 | |
| 			continue;
 | |
| 
 | |
| 		vcookie = fscache_try_get_volume(volume->vcookie,
 | |
| 						 fscache_volume_get_withdraw);
 | |
| 		if (vcookie) {
 | |
| 			spin_unlock(&cache->object_list_lock);
 | |
| 			fscache_withdraw_volume(vcookie);
 | |
| 			fscache_put_volume(vcookie, fscache_volume_put_withdraw);
 | |
| 			goto retry;
 | |
| 		}
 | |
| 	}
 | |
| 	spin_unlock(&cache->object_list_lock);
 | |
| 
 | |
| 	_leave("");
 | |
| }
 | |
| 
 | |
| /*
 | |
|  * Withdraw cachefiles volumes.
 | |
|  */
 | |
| static void cachefiles_withdraw_volumes(struct cachefiles_cache *cache)
 | |
| {
 | |
| 	_enter("");
 | |
| 
 | |
| 	for (;;) {
 | |
| 		struct fscache_volume *vcookie = NULL;
 | |
| 		struct cachefiles_volume *volume = NULL;
 | |
| 
 | |
| 		spin_lock(&cache->object_list_lock);
 | |
| 		if (!list_empty(&cache->volumes)) {
 | |
| 			volume = list_first_entry(&cache->volumes,
 | |
| 						  struct cachefiles_volume, cache_link);
 | |
| 			vcookie = fscache_try_get_volume(volume->vcookie,
 | |
| 							 fscache_volume_get_withdraw);
 | |
| 			if (!vcookie) {
 | |
| 				spin_unlock(&cache->object_list_lock);
 | |
| 				cpu_relax();
 | |
| 				continue;
 | |
| 			}
 | |
| 			list_del_init(&volume->cache_link);
 | |
| 		}
 | |
| 		spin_unlock(&cache->object_list_lock);
 | |
| 		if (!volume)
 | |
| 			break;
 | |
| 
 | |
| 		cachefiles_withdraw_volume(volume);
 | |
| 		fscache_put_volume(vcookie, fscache_volume_put_withdraw);
 | |
| 	}
 | |
| 
 | |
| 	_leave("");
 | |
| }
 | |
| 
 | |
| /*
 | |
|  * Sync a cache to backing disk.
 | |
|  */
 | |
| static void cachefiles_sync_cache(struct cachefiles_cache *cache)
 | |
| {
 | |
| 	const struct cred *saved_cred;
 | |
| 	int ret;
 | |
| 
 | |
| 	_enter("%s", cache->cache->name);
 | |
| 
 | |
| 	/* make sure all pages pinned by operations on behalf of the netfs are
 | |
| 	 * written to disc */
 | |
| 	cachefiles_begin_secure(cache, &saved_cred);
 | |
| 	down_read(&cache->mnt->mnt_sb->s_umount);
 | |
| 	ret = sync_filesystem(cache->mnt->mnt_sb);
 | |
| 	up_read(&cache->mnt->mnt_sb->s_umount);
 | |
| 	cachefiles_end_secure(cache, saved_cred);
 | |
| 
 | |
| 	if (ret == -EIO)
 | |
| 		cachefiles_io_error(cache,
 | |
| 				    "Attempt to sync backing fs superblock returned error %d",
 | |
| 				    ret);
 | |
| }
 | |
| 
 | |
| /*
 | |
|  * Withdraw cache objects.
 | |
|  */
 | |
| void cachefiles_withdraw_cache(struct cachefiles_cache *cache)
 | |
| {
 | |
| 	struct fscache_cache *fscache = cache->cache;
 | |
| 
 | |
| 	pr_info("File cache on %s unregistering\n", fscache->name);
 | |
| 
 | |
| 	fscache_withdraw_cache(fscache);
 | |
| 	cachefiles_withdraw_fscache_volumes(cache);
 | |
| 
 | |
| 	/* we now have to destroy all the active objects pertaining to this
 | |
| 	 * cache - which we do by passing them off to thread pool to be
 | |
| 	 * disposed of */
 | |
| 	cachefiles_withdraw_objects(cache);
 | |
| 	fscache_wait_for_objects(fscache);
 | |
| 
 | |
| 	cachefiles_withdraw_volumes(cache);
 | |
| 	cachefiles_sync_cache(cache);
 | |
| 	cache->cache = NULL;
 | |
| 	fscache_relinquish_cache(fscache);
 | |
| }
 |