linux-stable.git/fs/autofs, branch linux-5.4.y

autofs: fix memory leak of waitqueues in autofs_catatonic_mode

2023-09-23T09:00:02+00:00

[ Upstream commit ccbe77f7e45dfb4420f7f531b650c00c6e9c7507 ]

Syzkaller reports a memory leak:

BUG: memory leak
unreferenced object 0xffff88810b279e00 (size 96):
  comm "syz-executor399", pid 3631, jiffies 4294964921 (age 23.870s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 08 9e 27 0b 81 88 ff ff  ..........'.....
    08 9e 27 0b 81 88 ff ff 00 00 00 00 00 00 00 00  ..'.............
  backtrace:
    [] kmalloc_trace+0x20/0x90 mm/slab_common.c:1046
    [] kmalloc include/linux/slab.h:576 [inline]
    [] autofs_wait+0x3fa/0x9a0 fs/autofs/waitq.c:378
    [] autofs_do_expire_multi+0xa7/0x3e0 fs/autofs/expire.c:593
    [] autofs_expire_multi+0x53/0x80 fs/autofs/expire.c:619
    [] autofs_root_ioctl_unlocked+0x322/0x3b0 fs/autofs/root.c:897
    [] autofs_root_ioctl+0x25/0x30 fs/autofs/root.c:910
    [] vfs_ioctl fs/ioctl.c:51 [inline]
    [] __do_sys_ioctl fs/ioctl.c:870 [inline]
    [] __se_sys_ioctl fs/ioctl.c:856 [inline]
    [] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:856
    [] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [] entry_SYSCALL_64_after_hwframe+0x63/0xcd

autofs_wait_queue structs should be freed if their wait_ctr becomes zero.
Otherwise they will be lost.

In this case an AUTOFS_IOC_EXPIRE_MULTI ioctl is done, then a new
waitqueue struct is allocated in autofs_wait(), its initial wait_ctr
equals 2. After that wait_event_killable() is interrupted (it returns
-ERESTARTSYS), so that 'wq->name.name == NULL' condition may be not
satisfied. Actually, this condition can be satisfied when
autofs_wait_release() or autofs_catatonic_mode() is called and, what is
also important, wait_ctr is decremented in those places. Upon the exit of
autofs_wait(), wait_ctr is decremented to 1. Then the unmounting process
begins: kill_sb calls autofs_catatonic_mode(), which should have freed the
waitqueues, but it only decrements its usage counter to zero which is not
a correct behaviour.

edit:imk
This description is of course not correct. The umount performed as a result
of an expire is a umount of a mount that has been automounted, it's not the
autofs mount itself. They happen independently, usually after everything
mounted within the autofs file system has been expired away. If everything
hasn't been expired away the automount daemon can still exit leaving mounts
in place. But expires done in both cases will result in a notification that
calls autofs_wait_release() with a result status. The problem case is the
summary execution of of the automount daemon. In this case any waiting
processes won't be woken up until either they are terminated or the mount
is umounted.
end edit: imk

So in catatonic mode we should free waitqueues which counter becomes zero.

edit: imk
Initially I was concerned that the calling of autofs_wait_release() and
autofs_catatonic_mode() was not mutually exclusive but that can't be the
case (obviously) because the queue entry (or entries) is removed from the
list when either of these two functions are called. Consequently the wait
entry will be freed by only one of these functions or by the woken process
in autofs_wait() depending on the order of the calls.
end edit: imk

Reported-by: syzbot+5e53f70e69ff0c0a1c0c@syzkaller.appspotmail.com
Suggested-by: Takeshi Misawa 
Signed-off-by: Fedor Pchelkin 
Signed-off-by: Alexey Khoroshilov 
Signed-off-by: Ian Kent 
Cc: Matthew Wilcox 
Cc: Andrei Vagin 
Cc: autofs@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Message-Id: <169112719161.7590.6700123246297365841.stgit@donald.themaw.net>
Signed-off-by: Christian Brauner 
Signed-off-by: Sasha Levin

autofs: fix a leak in autofs_expire_indirect()

2019-10-25T04:03:11+00:00

if the second call of should_expire() in there ends up
grabbing and returning a new reference to dentry, we need
to drop it before continuing.

Signed-off-by: Al Viro

autofs_lookup(): hold ->d_lock over playing with ->d_flags

2019-07-27T14:03:14+00:00

... as well as setting ->d_fsdata, etc.  Make all of that
atomic.

Signed-off-by: Al Viro

get rid of autofs_info->active_count

2019-07-27T14:00:33+00:00

autofs_add_active() is always called only once (and on a dentry
with freshly allocated ino, at that).  autofs_del_active() is
never called more than once.

Signed-off-by: Al Viro

autofs: simplify get_next_positive_...(), get rid of trylocks

2019-07-25T03:02:21+00:00

* new helper: positive_after(parent, child); parent->d_lock is
held by caller, grabs and returns the first thing after child
in the list of children that has simple_positive() true.  NULL
if nothing's found; NULL child == search the entire list.

* get_next_positive_subdir() loses the redundant check for
d_count and switches to use of that helper.  BTW, dput(NULL) is
a no-op for a good reason...

* get_next_positive_dentry() switched to the same helper.  Logics:
look for positive child in prev; if not found, look for the
positive child of prev's parent following prev, etc.  That way
we are guaranteed that we are only moving rootwards through the
ancestors of prev, which is pinned and thus not going anywhere.
Since ->d_parent on autofs never changes, the same goes for
the entire chain of ancestors and we don't need overlapping
->d_lock on them.  Which avoids the trylock loops, in addition
to simplifying the logics in there...

Signed-off-by: Al Viro

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 83

2019-05-24T15:37:52+00:00

Based on 1 normalized pattern(s):

  this file is part of the linux kernel and is made available under
  the terms of the gnu general public license version 2 or at your
  option any later version incorporated herein by reference

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 18 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Richard Fontana 
Reviewed-by: Allison Randal 
Reviewed-by: Armijn Hemel 
Reviewed-by: Kate Stewart 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190520075211.321157221@linutronix.de
Signed-off-by: Greg Kroah-Hartman

treewide: Add SPDX license identifier - Makefile/Kconfig

2019-05-21T08:50:46+00:00

Add SPDX license identifiers to all Make/Kconfig files which:

 - Have no license information of any form

These files fall under the project license, GPL v2 only. The resulting SPDX
license identifier is:

  GPL-2.0-only

Signed-off-by: Thomas Gleixner 
Signed-off-by: Greg Kroah-Hartman

autofs: fix use-after-free in lockless ->d_manage()

2019-04-09T23:18:19+00:00

autofs_d_release() can overlap with lockless ->d_manage(),
ending up with autofs_dentry_ino() freed under the latter.
Make freeing autofs_info instances RCU-delayed...

Signed-off-by: Al Viro

autofs: clear O_NONBLOCK on the pipe

2019-03-08T02:32:01+00:00

autofs does not expect the pipe it is given to have O_NONBLOCK set -
specifically if __kernel_write() in autofs_write() returns -EAGAIN, this
is treated as a fatal error and the pipe is closed.

For safety autofs should, therefore, clear the O_NONBLOCK flag.

Releases of systemd prior to 8th February 2019 used
  pipe2(p, O_NONBLOCK|O_CLOEXEC)
and thus (inadvertently) set this flag.

Link: http://lkml.kernel.org/r/154993550902.3321.1183632970046073478.stgit@pluto-themaw-net
Signed-off-by: NeilBrown 
Signed-off-by: Ian Kent 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fs/autofs/inode.c: use seq_puts() for simple strings in autofs_show_options()

2019-03-08T02:32:01+00:00

Fix checkpatch.sh WARNING about the use of seq_printf() to print simple
strings in autofs_show_options(), use seq_puts() in this case.

Link: http://lkml.kernel.org/r/154889012613.4863.12231175554744203482.stgit@pluto-themaw-net
Signed-off-by: Ian Kent 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds