kernel.git/fs/nilfs2/inode.c, branch linux-6.3.y

nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()

2023-05-24T16:30:24Z

commit 9b5a04ac3ad9898c4745cba46ea26de74ba56a8e upstream. During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). However, since nilfs_evict_inode() uses nilfs_root for some cleanup operations, it may cause use-after-free read if inodes are left in "garbage_list" and released by nilfs_dispose_list() at the end of nilfs_detach_log_writer(). Fix this issue by modifying nilfs_evict_inode() to only clear inode without additional metadata changes that use nilfs_root if the file system is degraded to read-only or the writer is detached. Link: https://lkml.kernel.org/r/20230509152956.8313-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+78d4495558999f55d1da@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/00000000000099e5ac05fb1c3b85@google.com Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman

fs: port inode_init_owner() to mnt_idmap

2023-01-19T08:24:28Z

Convert to struct mnt_idmap. Last cycle we merged the necessary infrastructure in 256c8aed2b42 ("fs: introduce dedicated idmap type for mounts"). This is just the conversion to struct mnt_idmap. Currently we still pass around the plain namespace that was attached to a mount. This is in general pretty convenient but it makes it easy to conflate namespaces that are relevant on the filesystem with namespaces that are relevent on the mount level. Especially for non-vfs developers without detailed knowledge in this area this can be a potential source for bugs. Once the conversion to struct mnt_idmap is done all helpers down to the really low-level helpers will take a struct mnt_idmap argument instead of two namespace arguments. This way it becomes impossible to conflate the two eliminating the possibility of any bugs. All of the vfs and all filesystems only operate on struct mnt_idmap. Acked-by: Dave Chinner Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner (Microsoft)

fs: port ->permission() to pass mnt_idmap

2023-01-19T08:24:28Z

fs: port ->setattr() to pass mnt_idmap

2023-01-19T08:24:02Z

nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()

2022-10-12T02:05:45Z

If the i_mode field in inode of metadata files is corrupted on disk, it can cause the initialization of bmap structure, which should have been called from nilfs_read_inode_common(), not to be called. This causes a lockdep warning followed by a NULL pointer dereference at nilfs_bmap_lookup_at_level(). This patch fixes these issues by adding a missing sanitiy check for the i_mode field of metadata file's inode. Link: https://lkml.kernel.org/r/20221002030804.29978-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+2b32eb36c1a825b7a74c@syzkaller.appspotmail.com Reported-by: Tetsuo Handa Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton

nilfs2: fix use-after-free bug of struct nilfs_root

2022-10-12T02:05:44Z

If the beginning of the inode bitmap area is corrupted on disk, an inode with the same inode number as the root inode can be allocated and fail soon after. In this case, the subsequent call to nilfs_clear_inode() on that bogus root inode will wrongly decrement the reference counter of struct nilfs_root, and this will erroneously free struct nilfs_root, causing kernel oopses. This fixes the problem by changing nilfs_new_inode() to skip reserved inode numbers while repairing the inode bitmap. Link: https://lkml.kernel.org/r/20221003150519.39789-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+b8c672b0e22615c80fe0@syzkaller.appspotmail.com Reported-by: Khalid Masum Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton

nilfs2: Fix some kernel-doc comments

2022-05-12T14:49:23Z

The description of @flags in nilfs_dirty_inode() kernel-doc comment is missing, and some functions had kernel-doc that used a hash instead of a colon to separate the parameter name from the one line description. Fix them to remove some warnings found by running scripts/kernel-doc, which is caused by using 'make W=1'. fs/nilfs2/inode.c:73: warning: Function parameter or member 'inode' not described in 'nilfs_get_block' fs/nilfs2/inode.c:73: warning: Function parameter or member 'blkoff' not described in 'nilfs_get_block' fs/nilfs2/inode.c:73: warning: Function parameter or member 'bh_result' not described in 'nilfs_get_block' fs/nilfs2/inode.c:73: warning: Function parameter or member 'create' not described in 'nilfs_get_block' fs/nilfs2/inode.c:145: warning: Function parameter or member 'file' not described in 'nilfs_readpage' fs/nilfs2/inode.c:145: warning: Function parameter or member 'page' not described in 'nilfs_readpage' fs/nilfs2/inode.c:968: warning: Function parameter or member 'flags' not described in 'nilfs_dirty_inode' Link: https://lkml.kernel.org/r/20220324024215.63479-1-yang.lee@linux.alibaba.com Link: https://lkml.kernel.org/r/1652276316-7791-1-git-send-email-konishi.ryusuke@gmail.com Reported-by: Abaci Robot Signed-off-by: Yang Li Signed-off-by: Ryusuke Konishi Signed-off-by: Andrew Morton Signed-off-by: Matthew Wilcox (Oracle)

nilfs2: Remove comment about releasepage

2022-05-10T03:12:33Z

If we need a release_folio, we can add it back. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Jeff Layton

fs: Convert mpage_readpage to mpage_read_folio

2022-05-09T20:21:44Z

mpage_readpage still works in terms of pages, and has not been audited for correctness with large folios, so include an assertion that the filesystem is not passing it large folios. Convert all the filesystems to call mpage_read_folio() instead of mpage_readpage(). Signed-off-by: Matthew Wilcox (Oracle)

fs: Remove flags parameter from aops->write_begin

2022-05-08T18:28:19Z

There are no more aop flags left, so remove the parameter. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig