From patchwork Wed May 10 20:44:13 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1779692 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=E9QpxDbE; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4QGn7x422cz214l for ; Thu, 11 May 2023 06:44:28 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1pwqff-0006l7-Kz; Wed, 10 May 2023 20:44:23 +0000 Received: from smtp-relay-canonical-1.internal ([10.131.114.174] helo=smtp-relay-canonical-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1pwqfe-0006kr-99 for kernel-team@lists.ubuntu.com; Wed, 10 May 2023 20:44:22 +0000 Received: from quatroqueijos.. (unknown [179.93.171.50]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-1.canonical.com (Postfix) with ESMTPSA id 4EF454265E for ; Wed, 10 May 2023 20:44:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1683751462; bh=nwba1RManNQwC47+r/jm6EGipUA1jO5tfyLavOE0qIY=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=E9QpxDbEEmVKHv/N44UMvxtrvKvBwbBQJklvNZyAW0+YYoRG1P9CJ1f0FCw30bxvZ IkSOPEpBMp//tQtwoXNLbOqQyVicSLlg9lnxl2wO4dQKvn7xN4bxCnTSwFIij6wODr 9F8SodJFE3x5Nt8AhaMWyvNON1G26Sqre5SgO4mMwZ/qfcgJjURyVc4jDIETK3v8LL D0NqVmtmi/zWYp16wTklMlERETI11YTwe/aPJGmXc538WFEu28WhsyTIcqkPHbjgFj bgF67rjsrdYFh9kQHnHp2c8j7oxMLj2LmJPjNGCU1go+7BSGnqFx/PVyoJ4+V5RNPg lRJk5uvtCNXmQ== From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [SRU][L/K/J/F/OEM-5.17/OEM-6.0/OEM-6.1][PATCH 1/1] UBUNTU: SAUCE: shiftfs: prevent lock unbalance in shiftfs_create_object() Date: Wed, 10 May 2023 17:44:13 -0300 Message-Id: <20230510204413.615426-2-cascardo@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230510204413.615426-1-cascardo@canonical.com> References: <20230510204413.615426-1-cascardo@canonical.com> MIME-Version: 1.0 Lines: 36 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Andrea Righi Make sure to always acquire the inode lock of loweri_dir_iop when accessing its methods. This also prevents an lock unbalance when one of such methods is not implemented. Signed-off-by: Andrea Righi CVE-2023-2612 Signed-off-by: Thadeu Lima de Souza Cascardo Acked-by: Ian May --- fs/shiftfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/shiftfs.c b/fs/shiftfs.c index 2664e1fb65d30..e777d9f685938 100644 --- a/fs/shiftfs.c +++ b/fs/shiftfs.c @@ -409,6 +409,8 @@ static int shiftfs_create_object(struct inode *diri, struct dentry *dentry, const struct inode_operations *loweri_dir_iop = loweri_dir->i_op; struct dentry *lowerd_link = NULL; + inode_lock_nested(loweri_dir, I_MUTEX_PARENT); + if (hardlink) { loweri_iop_ptr = loweri_dir_iop->link; } else { @@ -434,8 +436,6 @@ static int shiftfs_create_object(struct inode *diri, struct dentry *dentry, goto out_iput; } - inode_lock_nested(loweri_dir, I_MUTEX_PARENT); - if (!hardlink) { inode = new_inode(dir_sb); if (!inode) {