qiurui
/
Centos-kernel-stream-9
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

afs: Fix merge preference rule failure condition 

JIRA: https://issues.redhat.com/browse/RHEL-77202

CVE: CVE-2025-21672

commit 17a4fde81d3a7478d97d15304a6d61094a10c2e3
Author: Lizhi Xu <lizhi.xu@windriver.com>
Date:   Tue Jan 7 14:52:32 2025 +0000

    afs: Fix merge preference rule failure condition

    syzbot reported a lock held when returning to userspace[1].  This is
    because if argc is less than 0 and the function returns directly, the held
    inode lock is not released.

    Fix this by store the error in ret and jump to done to clean up instead of
    returning directly.

    [dh: Modified Lizhi Xu's original patch to make it honour the error code
    from afs_split_string()]

    [1]
    WARNING: lock held when returning to user space!
    6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted
    ------------------------------------------------
    syz-executor133/5823 is leaving the kernel with locks still held!
    1 lock held by syz-executor133/5823:
     #0: ffff888071cffc00 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline]
     #0: ffff888071cffc00 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: afs_proc_addr_prefs_write+0x2bb/0x14e0 fs/afs/addr_prefs.c:388

    Reported-by: syzbot+76f33569875eb708e575@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=76f33569875eb708e575
    Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Link: https://lore.kernel.org/r/20241226012616.2348907-1-lizhi.xu@windriver.com/
    Link: https://lore.kernel.org/r/529850.1736261552@warthog.procyon.org.uk
    Tested-by: syzbot+76f33569875eb708e575@syzkaller.appspotmail.com
    cc: Marc Dionne <marc.dionne@auristor.com>
    cc: linux-afs@lists.infradead.org
    Signed-off-by: Christian Brauner <brauner@kernel.org>

Signed-off-by: Marc Dionne <mdionne@redhat.com>
This commit is contained in:
Marc Dionne 2025-02-27 11:51:55 -04:00
parent 188ff5f5a5
commit 6f05bd5024
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
fs/afs/addr_prefs.c
View File

@ -413,8 +413,10 @@ int afs_proc_addr_prefs_write(struct file *file, char *buf, size_t size)
do {
argc = afs_split_string(&buf, argv, ARRAY_SIZE(argv));
if (argc < 0)
return argc;
if (argc < 0) {
ret = argc;
goto done;
}
if (argc < 2)
goto inval;