ext4: fix use-after-free race in ext4_remount()'s error path

BugLink: https://bugs.launchpad.net/bugs/1836802
commit 33458eaba4dfe778a426df6a19b7aad2ff9f7eec upstream.

It's possible for ext4_show_quota_options() to try reading
s_qf_names[i] while it is being modified by ext4_remount() --- most
notably, in ext4_remount's error path when the original values of the
quota file name gets restored.

Reported-by: syzbot+a2872d6feea6918008a9@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org # 3.2+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 9cdea9192fce66b01b321c8fba9d5e40765284cb..50232c917d9a2e2336b8f0924d0078ed60d77480 100644 (file)
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1380,7 +1380,8 @@ struct ext4_sb_info {
        u32 s_min_batch_time;
        struct block_device *journal_bdev;
 #ifdef CONFIG_QUOTA
-       char *s_qf_names[EXT4_MAXQUOTAS];       /* Names of quota files with journalled quota */
+       /* Names of quota files with journalled quota */
+       char __rcu *s_qf_names[EXT4_MAXQUOTAS];
        int s_jquota_fmt;                       /* Format of quota to use */
 #endif
        unsigned int s_want_extra_isize; /* New inodes should reserve # bytes */

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 45bf1c77f627a1cac0a4c1d4a3eb26fb56f08617..6b6511a5d96f60bad24a4d1d30a5a7af31295c3e 100644 (file)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -860,6 +860,18 @@ static inline void ext4_quota_off_umount(struct super_block *sb)
        for (type = 0; type < EXT4_MAXQUOTAS; type++)
                ext4_quota_off(sb, type);
 }
+
+/*
+ * This is a helper function which is used in the mount/remount
+ * codepaths (which holds s_umount) to fetch the quota file name.
+ */
+static inline char *get_qf_name(struct super_block *sb,
+                               struct ext4_sb_info *sbi,
+                               int type)
+{
+       return rcu_dereference_protected(sbi->s_qf_names[type],
+                                        lockdep_is_held(&sb->s_umount));
+}
 #else
 static inline void ext4_quota_off_umount(struct super_block *sb)
 {
@@ -912,7 +924,7 @@ static void ext4_put_super(struct super_block *sb)
        percpu_free_rwsem(&sbi->s_journal_flag_rwsem);
 #ifdef CONFIG_QUOTA
        for (i = 0; i < EXT4_MAXQUOTAS; i++)
-               kfree(sbi->s_qf_names[i]);
+               kfree(get_qf_name(sb, sbi, i));
 #endif
 
        /* Debugging code just in case the in-memory inode orphan list
@@ -1480,11 +1492,10 @@ static const char deprecated_msg[] =
 static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
 {
        struct ext4_sb_info *sbi = EXT4_SB(sb);
-       char *qname;
+       char *qname, *old_qname = get_qf_name(sb, sbi, qtype);
        int ret = -1;
 
-       if (sb_any_quota_loaded(sb) &&
-               !sbi->s_qf_names[qtype]) {
+       if (sb_any_quota_loaded(sb) && !old_qname) {
                ext4_msg(sb, KERN_ERR,
                        "Cannot change journaled "
                        "quota options when quota turned on");
@@ -1501,8 +1512,8 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
                        "Not enough memory for storing quotafile name");
                return -1;
        }
-       if (sbi->s_qf_names[qtype]) {
-               if (strcmp(sbi->s_qf_names[qtype], qname) == 0)
+       if (old_qname) {
+               if (strcmp(old_qname, qname) == 0)
                        ret = 1;
                else
                        ext4_msg(sb, KERN_ERR,
@@ -1515,7 +1526,7 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
                        "quotafile must be on filesystem root");
                goto errout;
        }
-       sbi->s_qf_names[qtype] = qname;
+       rcu_assign_pointer(sbi->s_qf_names[qtype], qname);
        set_opt(sb, QUOTA);
        return 1;
 errout:
@@ -1527,15 +1538,16 @@ static int clear_qf_name(struct super_block *sb, int qtype)
 {
 
        struct ext4_sb_info *sbi = EXT4_SB(sb);
+       char *old_qname = get_qf_name(sb, sbi, qtype);
 
-       if (sb_any_quota_loaded(sb) &&
-               sbi->s_qf_names[qtype]) {
+       if (sb_any_quota_loaded(sb) && old_qname) {
                ext4_msg(sb, KERN_ERR, "Cannot change journaled quota options"
                        " when quota turned on");
                return -1;
        }
-       kfree(sbi->s_qf_names[qtype]);
-       sbi->s_qf_names[qtype] = NULL;
+       rcu_assign_pointer(sbi->s_qf_names[qtype], NULL);
+       synchronize_rcu();
+       kfree(old_qname);
        return 1;
 }
 #endif
@@ -1928,7 +1940,7 @@ static int parse_options(char *options, struct super_block *sb,
                         int is_remount)
 {
        struct ext4_sb_info *sbi = EXT4_SB(sb);
-       char *p;
+       char *p, __maybe_unused *usr_qf_name, __maybe_unused *grp_qf_name;
        substring_t args[MAX_OPT_ARGS];
        int token;
 
@@ -1959,11 +1971,13 @@ static int parse_options(char *options, struct super_block *sb,
                         "Cannot enable project quota enforcement.");
                return 0;
        }
-       if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
-               if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA])
+       usr_qf_name = get_qf_name(sb, sbi, USRQUOTA);
+       grp_qf_name = get_qf_name(sb, sbi, GRPQUOTA);
+       if (usr_qf_name || grp_qf_name) {
+               if (test_opt(sb, USRQUOTA) && usr_qf_name)
                        clear_opt(sb, USRQUOTA);
 
-               if (test_opt(sb, GRPQUOTA) && sbi->s_qf_names[GRPQUOTA])
+               if (test_opt(sb, GRPQUOTA) && grp_qf_name)
                        clear_opt(sb, GRPQUOTA);
 
                if (test_opt(sb, GRPQUOTA) || test_opt(sb, USRQUOTA)) {
@@ -1997,6 +2011,7 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
 {
 #if defined(CONFIG_QUOTA)
        struct ext4_sb_info *sbi = EXT4_SB(sb);
+       char *usr_qf_name, *grp_qf_name;
 
        if (sbi->s_jquota_fmt) {
                char *fmtname = "";
@@ -2015,11 +2030,14 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
                seq_printf(seq, ",jqfmt=%s", fmtname);
        }
 
-       if (sbi->s_qf_names[USRQUOTA])
-               seq_show_option(seq, "usrjquota", sbi->s_qf_names[USRQUOTA]);
-
-       if (sbi->s_qf_names[GRPQUOTA])
-               seq_show_option(seq, "grpjquota", sbi->s_qf_names[GRPQUOTA]);
+       rcu_read_lock();
+       usr_qf_name = rcu_dereference(sbi->s_qf_names[USRQUOTA]);
+       grp_qf_name = rcu_dereference(sbi->s_qf_names[GRPQUOTA]);
+       if (usr_qf_name)
+               seq_show_option(seq, "usrjquota", usr_qf_name);
+       if (grp_qf_name)
+               seq_show_option(seq, "grpjquota", grp_qf_name);
+       rcu_read_unlock();
 #endif
 }
 
@@ -5077,6 +5095,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
        int err = 0;
 #ifdef CONFIG_QUOTA
        int i, j;
+       char *to_free[EXT4_MAXQUOTAS];
 #endif
        char *orig_data = kstrdup(data, GFP_KERNEL);
 
@@ -5093,8 +5112,9 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
        old_opts.s_jquota_fmt = sbi->s_jquota_fmt;
        for (i = 0; i < EXT4_MAXQUOTAS; i++)
                if (sbi->s_qf_names[i]) {
-                       old_opts.s_qf_names[i] = kstrdup(sbi->s_qf_names[i],
-                                                        GFP_KERNEL);
+                       char *qf_name = get_qf_name(sb, sbi, i);
+
+                       old_opts.s_qf_names[i] = kstrdup(qf_name, GFP_KERNEL);
                        if (!old_opts.s_qf_names[i]) {
                                for (j = 0; j < i; j++)
                                        kfree(old_opts.s_qf_names[j]);
@@ -5316,9 +5336,12 @@ restore_opts:
 #ifdef CONFIG_QUOTA
        sbi->s_jquota_fmt = old_opts.s_jquota_fmt;
        for (i = 0; i < EXT4_MAXQUOTAS; i++) {
-               kfree(sbi->s_qf_names[i]);
-               sbi->s_qf_names[i] = old_opts.s_qf_names[i];
+               to_free[i] = get_qf_name(sb, sbi, i);
+               rcu_assign_pointer(sbi->s_qf_names[i], old_opts.s_qf_names[i]);
        }
+       synchronize_rcu();
+       for (i = 0; i < EXT4_MAXQUOTAS; i++)
+               kfree(to_free[i]);
 #endif
        kfree(orig_data);
        return err;
@@ -5508,7 +5531,7 @@ static int ext4_write_info(struct super_block *sb, int type)
  */
 static int ext4_quota_on_mount(struct super_block *sb, int type)
 {
-       return dquot_quota_on_mount(sb, EXT4_SB(sb)->s_qf_names[type],
+       return dquot_quota_on_mount(sb, get_qf_name(sb, EXT4_SB(sb), type),
                                        EXT4_SB(sb)->s_jquota_fmt, type);
 }