Ocfs2 devel - May 2023 - + ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch added to mm-hotfixes-unstable branch

The patch titled
     Subject: ocfs2: fix use-after-free when unmounting read-only filesystem
has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
     ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch

This patch will shortly appear at
    
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch

This patch will later appear in the mm-hotfixes-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your
code ***

The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days

------------------------------------------------------
From: Lu??s Henriques <ocfs2-devel at oss.oracle.com>
Subject: ocfs2: fix use-after-free when unmounting read-only filesystem
Date: Mon, 22 May 2023 11:21:12 +0100

It's trivial to trigger a use-after-free bug in the ocfs2 quotas code
using fstest generic/452.  After mounting a filesystem as read-only,
quotas are suspended and ocfs2_mem_dqinfo is freed through
->ocfs2_local_free_info().  When unmounting the filesystem, an UAF access
to the oinfo will eventually cause a crash.

Link: https://lkml.kernel.org/r/20230522102112.9031-1-lhenriques at suse.de
Signed-off-by: Lu??s Henriques <lhenriques at suse.de>
Reviewed-by: Joseph Qi <joseph.qi at linux.alibaba.com>
Tested-by: Joseph Qi <joseph.qi at linux.alibaba.com>
Cc: Mark Fasheh <mark at fasheh.com>
Cc: Joel Becker <jlbec at evilplan.org>
Cc: Junxiao Bi <junxiao.bi at oracle.com>
Cc: Changwei Ge <gechangwei at live.cn>
Cc: Gang He <ghe at suse.com>
Cc: Jun Piao <piaojun at huawei.com>
Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
---

 fs/ocfs2/super.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

---
a/fs/ocfs2/super.c~ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem
+++ a/fs/ocfs2/super.c
@@ -952,8 +952,10 @@ static void ocfs2_disable_quotas(struct
 	for (type = 0; type < OCFS2_MAXQUOTAS; type++) {
 		if (!sb_has_quota_loaded(sb, type))
 			continue;
-		oinfo = sb_dqinfo(sb, type)->dqi_priv;
-		cancel_delayed_work_sync(&oinfo->dqi_sync_work);
+		if (!sb_has_quota_suspended(sb, type)) {
+			oinfo = sb_dqinfo(sb, type)->dqi_priv;
+			cancel_delayed_work_sync(&oinfo->dqi_sync_work);
+		}
 		inode = igrab(sb->s_dquot.files[type]);
 		/* Turn off quotas. This will remove all dquot structures from
 		 * memory and so they will be automatically synced to global
_

Patches currently in -mm which might be from ocfs2-devel at oss.oracle.com are

ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch

Hi Andrew,

There is an updated version v2, which describe more clearly about the
case:
https://lore.kernel.org/ocfs2-devel/e9fc4b2f-1fcc-7c31-f346-59eccff50f9b at
linux.alibaba.com/T/#u

Thanks,
Joseph

On 5/26/23 4:55 AM, Andrew Morton wrote:
> The patch titled
>      Subject: ocfs2: fix use-after-free when unmounting read-only
filesystem
> has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
>      ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch
> 
> This patch will shortly appear at
>     
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch
> 
> This patch will later appear in the mm-hotfixes-unstable branch at
>     git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> 
> Before you just go and hit "reply", please:
>    a) Consider who else should be cc'ed
>    b) Prefer to cc a suitable mailing list as well
>    c) Ideally: find the original patch on the mailing list and do a
>       reply-to-all to that, adding suitable additional cc's
> 
> *** Remember to use Documentation/process/submit-checklist.rst when testing
your code ***
> 
> The -mm tree is included into linux-next via the mm-everything
> branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
> and is updated there every 2-3 working days
> 
> ------------------------------------------------------
> From: Lu?s Henriques <ocfs2-devel at oss.oracle.com>
> Subject: ocfs2: fix use-after-free when unmounting read-only filesystem
> Date: Mon, 22 May 2023 11:21:12 +0100
> 
> It's trivial to trigger a use-after-free bug in the ocfs2 quotas code
> using fstest generic/452.  After mounting a filesystem as read-only,
> quotas are suspended and ocfs2_mem_dqinfo is freed through
> ->ocfs2_local_free_info().  When unmounting the filesystem, an UAF
access
> to the oinfo will eventually cause a crash.
> 
> Link: https://lkml.kernel.org/r/20230522102112.9031-1-lhenriques at suse.de
> Signed-off-by: Lu?s Henriques <lhenriques at suse.de>
> Reviewed-by: Joseph Qi <joseph.qi at linux.alibaba.com>
> Tested-by: Joseph Qi <joseph.qi at linux.alibaba.com>
> Cc: Mark Fasheh <mark at fasheh.com>
> Cc: Joel Becker <jlbec at evilplan.org>
> Cc: Junxiao Bi <junxiao.bi at oracle.com>
> Cc: Changwei Ge <gechangwei at live.cn>
> Cc: Gang He <ghe at suse.com>
> Cc: Jun Piao <piaojun at huawei.com>
> Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
> ---
> 
>  fs/ocfs2/super.c |    6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> ---
a/fs/ocfs2/super.c~ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem
> +++ a/fs/ocfs2/super.c
> @@ -952,8 +952,10 @@ static void ocfs2_disable_quotas(struct
>  	for (type = 0; type < OCFS2_MAXQUOTAS; type++) {
>  		if (!sb_has_quota_loaded(sb, type))
>  			continue;
> -		oinfo = sb_dqinfo(sb, type)->dqi_priv;
> -		cancel_delayed_work_sync(&oinfo->dqi_sync_work);
> +		if (!sb_has_quota_suspended(sb, type)) {
> +			oinfo = sb_dqinfo(sb, type)->dqi_priv;
> +			cancel_delayed_work_sync(&oinfo->dqi_sync_work);
> +		}
>  		inode = igrab(sb->s_dquot.files[type]);
>  		/* Turn off quotas. This will remove all dquot structures from
>  		 * memory and so they will be automatically synced to global
> _
> 
> Patches currently in -mm which might be from ocfs2-devel at oss.oracle.com
are
> 
> ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch