Unverified Commit a64e4d48 authored by David Howells's avatar David Howells Committed by Christian Brauner
Browse files

afs: Fix afs_dynroot_readdir() to not use the RCU read lock 



afs_dynroot_readdir() uses the RCU read lock to walk the cell list whilst
emitting cell automount entries - but dir_emit() may write to a userspace
buffer, thereby causing a fault to occur and waits to happen.

Fix afs_dynroot_readdir() to get a shared lock on net->cells_lock instead.

This can be triggered by enabling lockdep, preconfiguring a number of
cells, doing "mount -t afs none /afs -o dyn" (or using the kafs-client
package with afs.mount systemd unit enabled) and then doing "ls /afs".

Fixes: 1d0b929f ("afs: Change dynroot to create contents on demand")
Reported-by: default avatar <syzbot+3b6c5c6a1d0119b687a1@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+8245611446194a52150d@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+1aa62e6852a6ad1c7944@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+54e6c2176ba76c56217e@syzkaller.appspotmail.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/1638014.1744145189@warthog.procyon.org.uk


cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent bb5e07cb

fs/afs/dynroot.c

+2 −2
Original line number Diff line number Diff line
@@ -348,9 +348,9 @@ static int afs_dynroot_readdir(struct file *file, struct dir_context *ctx) 
	}



	if ((unsigned long long)ctx->pos <= AFS_MAX_DYNROOT_CELL_INO) {

		rcu_read_lock();

		down_read(&net->cells_lock);

		ret = afs_dynroot_readdir_cells(net, ctx);

		rcu_read_unlock();

		up_read(&net->cells_lock);

	}

	return ret;

}