Baokun Li da4a827416 cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() ... We got the following issue in a fuzz test of randomly issuing the restore command: ================================================================== BUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963 CPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564 Call Trace: kasan_report+0x93/0xc0 cachefiles_ondemand_daemon_read+0xb41/0xb60 vfs_read+0x169/0xb50 ksys_read+0xf5/0x1e0 Allocated by task 116: kmem_cache_alloc+0x140/0x3a0 cachefiles_lookup_cookie+0x140/0xcd0 fscache_cookie_state_machine+0x43c/0x1230 [...] Freed by task 792: kmem_cache_free+0xfe/0x390 cachefiles_put_object+0x241/0x480 fscache_cookie_state_machine+0x5c8/0x1230 [...] ================================================================== Following is the process that triggers the issue: mount | daemon_thread1 | daemon_thread2 ------------------------------------------------------------ cachefiles_withdraw_cookie cachefiles_ondemand_clean_object(object) cachefiles_ondemand_send_req REQ_A = kzalloc(sizeof(*req) + data_len) wait_for_completion(&REQ_A->done) cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req msg->object_id = req->object->ondemand->ondemand_id ------ restore ------ cachefiles_ondemand_restore xas_for_each(&xas, req, ULONG_MAX) xas_set_mark(&xas, CACHEFILES_REQ_NEW) cachefiles_daemon_read cachefiles_ondemand_daemon_read REQ_A = cachefiles_ondemand_select_req copy_to_user(_buffer, msg, n) xa_erase(&cache->reqs, id) complete(&REQ_A->done) ------ close(fd) ------ cachefiles_ondemand_fd_release cachefiles_put_object cachefiles_put_object kmem_cache_free(cachefiles_object_jar, object) REQ_A->object->ondemand->ondemand_id // object UAF !!! When we see the request within xa_lock, req->object must not have been freed yet, so grab the reference count of object before xa_unlock to avoid the above issue. Fixes: 0a7e54c195 ("cachefiles: resend an open request if the read request's object is closed") Signed-off-by: Baokun Li <libaokun1@huawei.com> Link: https://lore.kernel.org/r/20240522114308.2402121-5-libaokun@huaweicloud.com Acked-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Jia Zhu <zhujia.zj@bytedance.com> Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com> Signed-off-by: Christian Brauner <brauner@kernel.org>		2024-05-29 13:03:29 +02:00
..
cache.c	cachefiles: fix memory leak in cachefiles_add_cache()	2024-02-20 09:46:07 +01:00
daemon.c	cachefiles: remove requests from xarray during flushing requests	2024-05-29 13:03:29 +02:00
error_inject.c	cachefiles: Remove the now superfluous sentinel element from ctl_table array	2023-12-28 04:57:57 -08:00
interface.c	cachefiles: extract ondemand info field from cachefiles_object	2023-11-25 16:03:57 +01:00
internal.h	cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()	2024-05-29 13:03:29 +02:00
io.c	vfs-6.8.netfs	2024-01-19 09:10:23 -08:00
Kconfig	netfs, fscache: Combine fscache with netfs	2023-12-24 15:08:46 +00:00
key.c	cachefiles: Implement key to filename encoding	2022-01-07 13:42:16 +00:00
main.c	cachefiles: Implement object lifecycle funcs	2022-01-07 13:42:08 +00:00
Makefile	cachefiles: notify the user daemon when looking up cookie	2022-05-18 00:11:17 +08:00
namei.c	rename(): avoid a deadlock in the case of parents having no common ancestor	2023-11-25 02:54:14 -05:00
ondemand.c	cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()	2024-05-29 13:03:29 +02:00
security.c	cachefiles: Add security derivation	2022-01-07 13:41:14 +00:00
volume.c	fscache, cachefiles: Store the volume coherency data	2022-01-07 13:43:03 +00:00
xattr.c	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00