Ryusuke Konishi d20dcec8f3 nilfs2: fix sysfs interface lifetime ... commit 42560f9c92 upstream. The current nilfs2 sysfs support has issues with the timing of creation and deletion of sysfs entries, potentially leading to null pointer dereferences, use-after-free, and lockdep warnings. Some of the sysfs attributes for nilfs2 per-filesystem instance refer to metadata file "cpfile", "sufile", or "dat", but nilfs_sysfs_create_device_group that creates those attributes is executed before the inodes for these metadata files are loaded, and nilfs_sysfs_delete_device_group which deletes these sysfs entries is called after releasing their metadata file inodes. Therefore, access to some of these sysfs attributes may occur outside of the lifetime of these metadata files, resulting in inode NULL pointer dereferences or use-after-free. In addition, the call to nilfs_sysfs_create_device_group() is made during the locking period of the semaphore "ns_sem" of nilfs object, so the shrinker call caused by the memory allocation for the sysfs entries, may derive lock dependencies "ns_sem" -> (shrinker) -> "locks acquired in nilfs_evict_inode()". Since nilfs2 may acquire "ns_sem" deep in the call stack holding other locks via its error handler __nilfs_error(), this causes lockdep to report circular locking. This is a false positive and no circular locking actually occurs as no inodes exist yet when nilfs_sysfs_create_device_group() is called. Fortunately, the lockdep warnings can be resolved by simply moving the call to nilfs_sysfs_create_device_group() out of "ns_sem". This fixes these sysfs issues by revising where the device's sysfs interface is created/deleted and keeping its lifetime within the lifetime of the metadata files above. Link: https://lkml.kernel.org/r/20230330205515.6167-1-konishi.ryusuke@gmail.com Fixes: dd70edbde2 ("nilfs2: integrate sysfs support into driver") Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Reported-by: syzbot+979fa7f9c0d086fdc282@syzkaller.appspotmail.com Link: https://lkml.kernel.org/r/0000000000003414b505f7885f7e@google.com Reported-by: syzbot+5b7d542076d9bddc3c6a@syzkaller.appspotmail.com Link: https://lkml.kernel.org/r/0000000000006ac86605f5f44eb9@google.com Cc: Viacheslav Dubeyko <slava@dubeyko.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-04-20 12:02:11 +02:00
..
9p	9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"	2022-06-25 11:46:24 +02:00
adfs	fs/adfs: super: fix use-after-free bug	2019-08-06 19:05:21 +02:00
affs	affs: initialize fsdata in affs_truncate()	2023-02-06 07:46:28 +01:00
afs	afs: Fix some tracing details	2020-04-02 16:34:33 +02:00
autofs4	autofs: fix a leak in autofs_expire_indirect()	2019-12-17 20:37:24 +01:00
befs
bfs	bfs: add sanity check at bfs_fill_super()	2018-12-01 09:42:51 +01:00
btrfs	btrfs: send: limit number of clones and allocated memory size	2023-03-11 16:26:32 +01:00
cachefiles	cachefiles: Handle readpage error correctly	2020-11-05 11:07:05 +01:00
ceph	ceph: don't truncate file in atomic_open	2022-10-26 13:16:53 +02:00
cifs	cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL	2023-04-05 11:14:20 +02:00
coda	coda: add error handling for fget	2019-08-06 19:05:23 +02:00
configfs	configfs: fix a race in configfs_{,un}register_subsystem()	2022-03-02 11:33:56 +01:00
cramfs	Cramfs: fix abad comparison when wrap-arounds occur	2018-11-13 11:15:12 -08:00
crypto	fscrypt: don't ignore minor_hash when hash is 0	2021-07-20 16:17:45 +02:00
debugfs	debugfs: fix use-after-free on symlink traversal	2019-05-08 07:20:49 +02:00
devpts	fs/devpts: always delete dcache dentry-s in dput()	2019-03-23 14:35:21 +01:00
dlm	fs: dlm: handle -EBUSY first in lock arg validation	2022-10-26 13:16:55 +02:00
ecryptfs	Revert "ecryptfs: replace BUG_ON with error handling code"	2021-05-26 11:47:00 +02:00
efivarfs	efivarfs: revert "fix memory leak in efivarfs_create()"	2020-12-02 08:34:44 +01:00
efs
exofs	exofs_mount(): fix leaks on failure exits	2019-12-05 15:37:28 +01:00
exportfs	exportfs: fix 'passing zero to ERR_PTR()' warning	2020-01-27 14:46:06 +01:00
ext2	ext2: Add more validity checks for inode counts	2022-08-25 11:11:14 +02:00
ext4	ext4: fix kernel BUG in 'ext4_write_inline_data_end()'	2023-04-05 11:14:21 +02:00
f2fs	f2fs: fix information leak in f2fs_move_inline_dirents()	2023-03-11 16:26:44 +01:00
fat	fat: add ratelimit to fat*_ent_bread()	2022-06-14 16:53:46 +02:00
freevxfs
fscache	fscache: fix race between enablement and dropping of object	2018-12-17 09:28:53 +01:00
fuse	fuse: limit nsec	2022-08-25 11:11:12 +02:00
gfs2	gfs2: Switch from strlcpy to strscpy	2022-11-25 17:36:55 +01:00
hfs	hfs: fix missing hfs_bnode_get() in __hfs_bnode_create	2023-03-11 16:26:44 +01:00
hfsplus	fs: hfsplus: fix UAF issue in hfsplus_put_super	2023-03-11 16:26:44 +01:00
hostfs
hpfs
hugetlbfs	hugetlbfs: hugetlb_fault_mutex_hash() cleanup	2021-06-03 08:36:25 +02:00
isofs	isofs: Fix out of bound access for corrupted isofs image	2021-11-12 14:28:24 +01:00
jbd2	jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted	2022-08-25 11:11:23 +02:00
jffs2	jffs2: fix memory leak in jffs2_do_fill_super	2022-06-14 16:53:57 +02:00
jfs	fs/jfs: fix shift exponent db_agl2size negative	2023-03-11 16:26:50 +01:00
kernfs	kernfs: fix use-after-free in __kernfs_remove	2022-11-03 23:50:53 +09:00
lockd	lockd: don't use interval-based rebinding over TCP	2020-12-29 13:46:57 +01:00
minix	fs/minix: reject too-large maximum file size	2020-08-21 09:48:15 +02:00
ncpfs
nfs	pNFS/filelayout: Fix coalescing test for single DS	2023-01-24 07:05:18 +01:00
nfs_common	nfs_common: need lock during iterate through the list	2020-12-29 13:47:01 +01:00
nfsd	nfsd: fix handling of readdir in v4root vs. mount upcall timeout	2023-01-18 09:26:41 +01:00
nilfs2	nilfs2: fix sysfs interface lifetime	2023-04-20 12:02:11 +02:00
nls
notify	fsnotify: fix wrong lockdep annotations	2022-06-14 16:53:48 +02:00
ntfs	ntfs: check overflow when iterating ATTR_RECORDs	2022-11-25 17:36:55 +01:00
ocfs2	ocfs2: fix data corruption after failed write	2023-04-05 11:14:19 +02:00
omfs
openpromfs
orangefs	orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()	2023-01-18 09:26:33 +01:00
overlayfs	ovl: fix missing negative dentry check in ovl_rename()	2021-10-17 10:08:32 +02:00
proc	mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps	2023-02-22 12:46:03 +01:00
pstore	pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES	2023-01-18 09:26:34 +01:00
qnx4	qnx4: work around gcc false positive warning bug	2021-10-06 15:05:08 +02:00
qnx6
quota	quota: Check next/prev free block number after reading from quota file	2022-10-26 13:16:56 +02:00
ramfs	ramfs: fix nommu mmap with gaps in the page cache	2020-10-29 09:07:11 +01:00
reiserfs	fs: reiserfs: remove useless new_opts in reiserfs_remount	2023-02-06 07:46:30 +01:00
romfs	romfs: fix uninitialized memory leak in romfs_dev_read()	2020-08-26 10:29:54 +02:00
squashfs	revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"	2023-02-22 12:46:05 +01:00
sysfs	fs: sysfs_emit_at: Remove PAGE_SIZE alignment check	2023-03-22 13:26:13 +01:00
sysv	fs: sysv: Fix sysv_nblocks() returns wrong value	2023-01-18 09:26:11 +01:00
tracefs	tracefs: Only clobber mode/uid/gid on remount if asked	2022-09-20 11:51:31 +02:00
ubifs	ubifs: ubifs_writepage: Mark page dirty after writing inode failed	2023-03-11 16:26:51 +01:00
udf	udf: Fix file corruption when appending just after end of preallocated extent	2023-03-11 16:26:45 +01:00
ufs	fs/ufs: avoid potential u32 multiplication overflow	2020-08-21 09:48:22 +02:00
xfs	xfs: remove incorrect ASSERT in xfs_rename	2022-07-12 16:27:28 +02:00
aio.c	aio: fix mremap after fork null-deref	2023-02-22 12:46:05 +01:00
anon_inodes.c
attr.c	vfs: Check the truncate maximum size in inode_newsize_ok()	2022-08-25 11:11:11 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c	fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()	2020-06-03 08:18:03 +02:00
binfmt_elf_fdpic.c
binfmt_em86.c
binfmt_flat.c	binfmt_flat: do not stop relocating GOT entries prematurely on riscv	2022-06-14 16:53:43 +02:00
binfmt_misc.c	binfmt_misc: fix shift-out-of-bounds in check_special_flags	2023-01-18 09:26:29 +01:00
binfmt_script.c	exec: load_script: Do not exec truncated interpreter path	2019-11-06 12:42:59 +01:00
block_dev.c	block: reexpand iov_iter after read/write	2021-05-22 10:57:43 +02:00
buffer.c	mm: fs: initialize fsdata passed to write_begin/write_end interface	2022-11-25 17:36:55 +01:00
char_dev.c	chardev: fix error handling in cdev_device_add()	2023-01-18 09:26:24 +01:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c	fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP	2020-01-09 10:17:58 +01:00
coredump.c	coredump: fix crash when umh is disabled	2020-05-20 08:16:58 +02:00
dax.c	dax: pass NOWAIT flag to iomap_apply	2020-03-11 18:02:43 +01:00
dcache.c	fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb()	2019-02-06 17:31:34 +01:00
dcookies.c
direct-io.c	fs: direct-io: fix missing sdio->boundary	2021-04-16 11:57:48 +02:00
drop_caches.c	fs: avoid softlockups in s_inodes iterators	2020-01-12 12:11:59 +01:00
eventfd.c
eventpoll.c	ep_create_wakeup_source(): dentry name can change under you...	2020-10-14 09:51:09 +02:00
exec.c	exec: Force single empty string when argv is empty	2022-06-06 08:20:57 +02:00
fcntl.c
fhandle.c
file.c	fs: prevent out-of-bounds array speculation when closing a file descriptor	2023-03-17 08:30:36 +01:00
file_table.c	fs: add fget_many() and fput_many()	2021-12-08 08:46:55 +01:00
filesystems.c	fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()	2020-04-24 08:00:43 +02:00
fs-writeback.c	fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages	2022-06-14 16:53:52 +02:00
fs_pin.c
fs_struct.c
inode.c	fs: fix UAF/GPF bug in nilfs_mdt_destroy	2022-10-26 13:16:51 +02:00
internal.h
ioctl.c	vfs: swap names of {do,vfs}_clone_file_range()	2018-11-10 07:48:33 -08:00
iomap.c	iomap: Fix pipe page leakage during splicing	2019-12-17 20:38:57 +01:00
Kconfig
Kconfig.binfmt
libfs.c	libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value	2023-01-18 09:26:10 +01:00
locks.c	locks: print unsigned ino in /proc/locks	2020-01-09 10:17:55 +01:00
Makefile
mbcache.c
mount.h
mpage.c
namei.c	mm: fs: initialize fsdata passed to write_begin/write_end interface	2022-11-25 17:36:55 +01:00
namespace.c	VFS: Fix memory leak caused by concurrently mounting fs with subtype	2022-05-15 19:40:27 +02:00
no-block.c
nsfs.c
open.c	cifs_atomic_open(): fix double-put on late allocation failure	2020-03-20 10:54:16 +01:00
pipe.c	pipe: increase minimum default pipe size to 2 pages	2021-08-15 13:03:31 +02:00
pnode.c	pnode: terminate at peers of source	2023-01-18 09:26:35 +01:00
pnode.h
posix_acl.c
proc_namespace.c
read_write.c	vfs: avoid problematic remapping requests into partial EOF block	2019-12-01 09:13:51 +01:00
readdir.c	readdir: make sure to verify directory entry for legacy interfaces too	2021-04-28 12:08:41 +02:00
select.c	kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()	2021-03-24 11:05:05 +01:00
seq_file.c	seq_file: disallow extremely large seq buffer allocations	2021-07-20 16:17:55 +02:00
signalfd.c	signalfd: use wake_up_pollfree()	2021-12-14 10:16:55 +01:00
splice.c	Revert "fs: check FMODE_LSEEK to control internal pipe splicing"	2022-10-26 13:16:56 +02:00
stack.c
stat.c	stat: fix inconsistency between struct stat and struct compat_stat	2022-04-27 13:15:30 +02:00
statfs.c	vfs: Fix EOVERFLOW testing in put_compat_statfs64	2019-10-11 18:18:48 +02:00
super.c	vfs: make freeze_super abort when sync_filesystem returns error	2022-02-23 11:57:33 +01:00
sync.c
timerfd.c
userfaultfd.c	userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK	2020-01-04 13:59:58 +01:00
utimes.c
xattr.c	fs: don't audit the capability check in simple_xattr_list()	2023-01-18 09:26:09 +01:00