Merge patch series "fs: fix a range of UAFs during rcu pathwalk caused by non-rcu frees"

Christian Brauner <brauner@kernel.org> says:

While working on eliding the grace period in namespace_unlock() I went
through what filesystems free when they're shut down and what a pathwalk
in rcu mode can still read at that point. Since 66a97c2ec953's rcu
pathwalk fixes that's the filesystem's job. Whatever ->permission(),
->d_revalidate(), ->get_link(), ->d_hash() and ->d_compare() look at in
rcu mode has to be freed after a grace period. A few filesystems don't
do that.

Most of it is hidden by umount(2). namespace_unlock() waits for a grace
period before it drops the mounts, so a walker that was inside the
filesystem is gone by the time the filesystem is shut down.

But the last reference to a mount doesn't have to go away in umount(2).
A chdir() out of a lazily unmounted directory or the close() of the last
file on it drops it without a grace period. A walker can then still be
in the filesystem while ->put_super() and ->kill_sb() free what it
reads.

With KASAN on vfs.fixes:

- ext4_get_link() reads sb->s_fs_info and the extent status counters in
  rcu mode for a symlink that keeps its target in a data block.

  ext4_put_super() destroys the counters, clears s_fs_info and frees the
  sbi right away. That's a NULL dereference, a use-after-free of the sbi
  or a fault on a destroyed percpu counter, depending on where the
  walker sits.

- The unicode map of casefolded ext4, f2fs and tmpfs is freed from
  ->put_super() while generic_ci_d_hash() and generic_ci_d_compare() use
  it.

- ntfs3 with nocase frees its sbi and mount options under ntfs_d_hash()
  and ntfs_d_compare(). A remount frees the old mount options right away
  too, that one needs no unmount at all.

- eventfs frees an eventfs_inode after an SRCU grace period only, but
  tracefs_d_revalidate() reads it under rcu_read_lock(). No unmount
  needed either.

The ipc patch is a different kind of bug. create_ipc_ns() leaks the
mqueue mount and its superblock when it fails after mq_init_ns(). I ran
into it while looking at the kern_unmount() users.

afs and 9p look just as broken but nothing can reach it today. Both
have a private bdi, and generic_shutdown_super() calls bdi_unregister(),
which waits for a grace period before ->kill_sb() frees their private
data. That grace period is there for the rcu readers of bdi_list and
covers afs and 9p by accident. I don't want them to depend on that, so
they free their private data after a grace period of their own as well.

I appended the reproducers. The race reproducers hold a pathwalk inside
the filesystem's callback for two seconds with a kprobe while the other
side frees what it reads. For the ntfs3 remount the window is a single
load and its dereference, so that one needs an mdelay() in the kernel.
ext4 with a journal needs a kernel without lockdep since
jbd2_journal_destroy() calls lockdep_unregister_key(), which waits for a
grace period too.

Clean this all up.

* patches from https://patch.msgid.link/20261009-work-fixes-rcu-v1-0-7446d2d335e6@kernel.org:
  ntfs3: free replaced mount options after a grace period
  ntfs3: free the sbi after a grace period
  unicode: free the map after a grace period
  ipc: drop the mqueue mount with kern_unmount() on setup failure
  eventfs: free the eventfs_inode after an rcu grace period too
  9p: free the session after a grace period
  afs: free the super info after a grace period
  ext4: free the sbi after a grace period

Link: https://patch.msgid.link/20261009-work-fixes-rcu-v1-0-7446d2d335e6@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

0 files changed, 0 insertions, 0 deletions