[PATCH 3.13.y-ckt 26/57] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()

From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.13.y-ckt 26/57] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()
Date	2015-09-22 21:20 +0200
Message-ID	<qbBgE-665-63@gated-at.bofh.it> (permalink)
References	<qbzRv-3UF-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.13.11-ckt27 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Kara <jack@suse.com>

commit 8f2f3eb59dff4ec538de55f2e0592fec85966aab upstream.

fsnotify_clear_marks_by_group_flags() can race with
fsnotify_destroy_marks() so that when fsnotify_destroy_mark_locked()
drops mark_mutex, a mark from the list iterated by
fsnotify_clear_marks_by_group_flags() can be freed and thus the next
entry pointer we have cached may become stale and we dereference free
memory.

Fix the problem by first moving marks to free to a special private list
and then always free the first entry in the special list.  This method
is safe even when entries from the list can disappear once we drop the
lock.

Signed-off-by: Jan Kara <jack@suse.com>
Reported-by: Ashish Sangwan <a.sangwan@samsung.com>
Reviewed-by: Ashish Sangwan <a.sangwan@samsung.com>
Cc: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 fs/notify/mark.c | 30 +++++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index 923fe4a..6bffc33 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -293,16 +293,36 @@ void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group,
 					 unsigned int flags)
 {
 	struct fsnotify_mark *lmark, *mark;
+	LIST_HEAD(to_free);
 
+	/*
+	 * We have to be really careful here. Anytime we drop mark_mutex, e.g.
+	 * fsnotify_clear_marks_by_inode() can come and free marks. Even in our
+	 * to_free list so we have to use mark_mutex even when accessing that
+	 * list. And freeing mark requires us to drop mark_mutex. So we can
+	 * reliably free only the first mark in the list. That's why we first
+	 * move marks to free to to_free list in one go and then free marks in
+	 * to_free list one by one.
+	 */
 	mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
 	list_for_each_entry_safe(mark, lmark, &group->marks_list, g_list) {
-		if (mark->flags & flags) {
-			fsnotify_get_mark(mark);
-			fsnotify_destroy_mark_locked(mark, group);
-			fsnotify_put_mark(mark);
-		}
+		if (mark->flags & flags)
+			list_move(&mark->g_list, &to_free);
 	}
 	mutex_unlock(&group->mark_mutex);
+
+	while (1) {
+		mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING);
+		if (list_empty(&to_free)) {
+			mutex_unlock(&group->mark_mutex);
+			break;
+		}
+		mark = list_first_entry(&to_free, struct fsnotify_mark, g_list);
+		fsnotify_get_mark(mark);
+		fsnotify_destroy_mark_locked(mark, group);
+		mutex_unlock(&group->mark_mutex);
+		fsnotify_put_mark(mark);
+	}
 }
 
 /*
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[3.13.y-ckt stable] Linux 3.13.11-ckt27 stable review Kamal Mostafa <kamal@canonical.com> - 2015-09-22 19:50 +0200
  [PATCH 3.13.y-ckt 15/57] target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT Kamal Mostafa <kamal@canonical.com> - 2015-09-22 19:50 +0200
  [PATCH 3.13.y-ckt 12/57] xen-blkback: replace work_pending with work_busy in purge_persistent_gnt() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 19:50 +0200
  [PATCH 3.13.y-ckt 16/57] rbd: fix copyup completion race Kamal Mostafa <kamal@canonical.com> - 2015-09-22 19:50 +0200
  [PATCH 3.13.y-ckt 57/57] net: gso: use feature flag argument in all protocol gso handlers Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 50/57] ipv6: lock socket in ip6_datagram_connect() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 47/57] rds: fix an integer overflow test in rds_info_getsockopt() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 53/57] net: pktgen: fix race between pktgen_thread_worker() and kthread_stop() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 54/57] net: call rcu_read_lock early in process_backlog Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 52/57] net/tipc: initialize security state for new connection socket Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 40/57] ipc/sem.c: update/correct memory barriers Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 21/57] perf: Fix fasync handling on inherited events Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 51/57] rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 56/57] netlink: don't hold mutex in rcu callback when releasing mmapd ring Kamal Mostafa <kamal@canonical.com> - 2015-09-22 20:00 +0200
  [PATCH 3.13.y-ckt 48/57] udp: fix dst races with multicast early demux Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:00 +0200
  [PATCH 3.13.y-ckt 49/57] sparc64: Fix userspace FPU register corruptions. Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:00 +0200
  [PATCH 3.13.y-ckt 44/57] ip6_gre: release cached dst on tunnel removal Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:00 +0200
  [PATCH 3.13.y-ckt 46/57] net: Fix skb_set_peeked use-after-free bug Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:00 +0200
  [PATCH 3.13.y-ckt 39/57] ipc/sem.c: change memory barrier in sem_lock() to smp_rmb() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 43/57] batman-adv: protect tt_local_entry from concurrent delete events Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 36/57] crypto: caam - fix memory corruption in ahash_final_ctx Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 32/57] libiscsi: Fix host busy blocking during connection teardown Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 24/57] ipc: modify message queue accounting to not take kernel data structures into account Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 42/57] arm64: KVM: Fix host crash when injecting a fault into a 32bit guest Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 35/57] EDAC, ppc4xx: Access mci->csrows array elements properly Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 33/57] libfc: Fix fc_exch_recv_req() error path Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 38/57] ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 37/57] mm/hwpoison: fix page refcount of unknown non LRU page Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 25/57] ocfs2: fix BUG in ocfs2_downconvert_thread_do_work() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 17/57] md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 45/57] net: Fix RCU splat in af_key Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 34/57] libfc: Fix fc_fcp_cleanup_each_cmd() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 41/57] Add factory recertified Crucial M500s to blacklist Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:10 +0200
  [PATCH 3.13.y-ckt 04/57] virtio-net: drop NETIF_F_FRAGLIST Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 14/57] regmap: regcache-rbtree: Clean new present bits on present bitmap resize Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 27/57] KVM: x86: Use adjustment in guest cycles when handling MSR_IA32_TSC_ADJUST Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 05/57] RDS: verify the underlying transport exists before creating a connection Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 07/57] xen/gntdevt: Fix race condition in gntdev_release() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 13/57] USB: sierra: add 1199:68AB device ID Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 31/57] drm/radeon: add new OLAND pci id Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 10/57] crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 29/57] dm thin metadata: delete btrees when releasing metadata snapshot Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 20/57] xhci: fix off by one error in TRB DMA address boundary check Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 30/57] dm btree: add ref counting ops for the leaves of top level btrees Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 18/57] target: REPORT LUNS should return LUN 0 even for dynamic ACLs Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 02/57] md: flush ->event_work before stopping array. Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 03/57] ipv6: addrconf: validate new MTU before applying it Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 22/57] mm, vmscan: Do not wait for page writeback for GFP_NOFS allocations Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 19/57] MIPS: Fix sched_getaffinity with MT FPAFF enabled Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 28/57] localmodconfig: Use Kbuild files too Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 09/57] nfsd: Drop BUG_ON and ignore SECLABEL on absent filesystem Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 11/57] xen-blkfront: don't add indirect pages to list when !feature_persistent Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 08/57] PCI: Restore PCI_MSIX_FLAGS_BIRMASK definition Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 23/57] MIPS: Make set_pte() SMP safe. Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200
  [PATCH 3.13.y-ckt 26/57] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() Kamal Mostafa <kamal@canonical.com> - 2015-09-22 21:20 +0200

csiph-web