Linus Torvalds 4baba6ba56 fget: check that the fd still exists after getting a ref to it ... commit 054aa8d439 upstream. Jann Horn points out that there is another possible race wrt Unix domain socket garbage collection, somewhat reminiscent of the one fixed in commit cbcf01128d ("af_unix: fix garbage collect vs MSG_PEEK"). See the extended comment about the garbage collection requirements added to unix_peek_fds() by that commit for details. The race comes from how we can locklessly look up a file descriptor just as it is in the process of being closed, and with the right artificial timing (Jann added a few strategic 'mdelay(500)' calls to do that), the Unix domain socket garbage collector could see the reference count decrement of the close() happen before fget() took its reference to the file and the file was attached onto a new file descriptor. This is all (intentionally) correct on the 'struct file *' side, with RCU lookups and lockless reference counting very much part of the design. Getting that reference count out of order isn't a problem per se. But the garbage collector can get confused by seeing this situation of having seen a file not having any remaining external references and then seeing it being attached to an fd. In commit cbcf01128d ("af_unix: fix garbage collect vs MSG_PEEK") the fix was to serialize the file descriptor install with the garbage collector by taking and releasing the unix_gc_lock. That's not really an option here, but since this all happens when we are in the process of looking up a file descriptor, we can instead simply just re-check that the file hasn't been closed in the meantime, and just re-do the lookup if we raced with a concurrent close() of the same file descriptor. Reported-and-tested-by: Jann Horn <jannh@google.com> Acked-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-12-08 09:03:21 +01:00
..
9p	new helper: inode_wrong_type()	2021-09-08 08:49:01 +02:00
adfs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
affs	fs/affs: release old buffer head on error path	2021-03-04 11:38:37 +01:00
afs	afs: Fix updating of i_blocks on file/dir extension	2021-09-30 10:11:01 +02:00
autofs	autofs: harden ioctl table	2020-10-16 11:11:22 -07:00
befs
bfs	bfs: don't use WARNING: string when it's just info.	2021-01-06 14:56:52 +01:00
btrfs	btrfs: check-integrity: fix a warning on write caching disabled disk	2021-12-08 09:03:19 +01:00
cachefiles	fs/cachefiles: Remove wait_bit_key layout dependency	2021-03-30 14:32:07 +02:00
ceph	ceph: properly handle statfs on multifs setups	2021-12-01 09:19:08 +01:00
cifs	smb3: do not error on fsync when readonly	2021-12-01 09:19:08 +01:00
coda
configfs	configfs: fix memleak in configfs_release_bin_file	2021-07-14 16:56:48 +02:00
cramfs
crypto	fscrypt: allow 256-bit master keys with AES-256-XTS	2021-11-18 14:03:54 +01:00
debugfs	debugfs: debugfs_create_file_size(): use IS_ERR to check for error	2021-10-06 15:55:59 +02:00
devpts
dlm	fs: dlm: fix memory leak when fenced	2021-07-14 16:55:59 +02:00
ecryptfs	Revert "ecryptfs: replace BUG_ON with error handling code"	2021-05-26 12:06:55 +02:00
efivarfs	efivarfs: revert "fix memory leak in efivarfs_create()"	2020-11-25 16:55:02 +01:00
efs
erofs	erofs: fix deadlock when shrink erofs slab	2021-12-01 09:19:05 +01:00
exfat	exfat: fix incorrect loading of i_blocks for large files	2021-11-18 14:03:37 +01:00
exportfs
ext2	ext2: fix sleeping in atomic bugs on error	2021-10-09 14:40:56 +02:00
ext4	ext4: refresh the ext4_ext_path struct after dropping i_data_sem.	2021-11-18 14:03:40 +01:00
f2fs	f2fs: set SBI_NEED_FSCK flag when inconsistent node block found	2021-12-01 09:19:08 +01:00
fat
freevxfs
fscache	fscache: Fix cookie key hashing	2021-09-18 13:40:15 +02:00
fuse	fuse: release pipe buf after last use	2021-12-01 09:19:00 +01:00
gfs2	gfs2: Fix length of holes reported at end-of-file	2021-12-08 09:03:18 +01:00
hfs	hfs: add lock nesting notation to hfs_find_init	2021-07-31 08:16:12 +02:00
hfsplus	hfsplus: prevent corruption in shrinking truncate	2021-05-19 10:13:10 +02:00
hostfs	hostfs: fix memory handling in follow_link()	2021-04-14 08:42:06 +02:00
hpfs
hugetlbfs	hugetlbfs: fix mount mode command line processing	2021-07-28 14:35:46 +02:00
iomap	treewide: Change list_sort to use const pointers	2021-09-30 10:11:04 +02:00
isofs	isofs: Fix out of bound access for corrupted isofs image	2021-11-12 14:58:33 +01:00
jbd2	ext4: fix debug format string warning	2021-05-19 10:13:19 +02:00
jffs2	jffs2: check the validity of dstlen in jffs2_zlib_compress()	2021-05-11 14:47:36 +02:00
jfs	JFS: fix memleak in jfs_mount	2021-11-18 14:04:15 +01:00
kernfs	kernfs: wire up ->splice_read and ->splice_write	2021-01-27 11:55:29 +01:00
lockd	lockd: lockd server-side shouldn't set fl_ops	2021-09-18 13:40:30 +02:00
minix
nfs	NFSv42: Fix pagecache invalidation after COPY/CLONE	2021-12-08 09:03:17 +01:00
nfs_common	nfs_common: need lock during iterate through the list	2020-12-30 11:53:45 +01:00
nfsd	NFSD: Keep existing listeners on portlist error	2021-10-27 09:56:47 +02:00
nilfs2	nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group	2021-09-26 14:09:01 +02:00
nls
notify	fanotify: limit number of event merge attempts	2021-09-18 13:40:38 +02:00
ntfs	ntfs: fix validity check for file name attribute	2021-07-14 16:55:38 +02:00
ocfs2	ocfs2: fix data corruption on truncate	2021-11-18 14:03:37 +01:00
omfs
openpromfs
orangefs	fs: orangefs: fix error return code of orangefs_revalidate_lookup()	2021-11-18 14:04:23 +01:00
overlayfs	ovl: fix deadlock in splice write	2021-12-08 09:03:18 +01:00
proc	proc/vmcore: fix clearing user buffer by properly using clear_user()	2021-12-01 09:19:02 +01:00
pstore	mark pstore-blk as broken	2021-07-14 16:56:12 +02:00
qnx4	qnx4: work around gcc false positive warning bug	2021-09-30 10:11:08 +02:00
qnx6
quota	quota: correct error number in free_dqentry()	2021-11-18 14:03:51 +01:00
ramfs	ramfs: fix nommu mmap with gaps in the page cache	2020-10-16 11:11:22 -07:00
reiserfs	reiserfs: check directory items on read from disk	2021-08-12 13:22:19 +02:00
romfs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
squashfs	squashfs: fix divide error in calculate_skip()	2021-05-19 10:13:10 +02:00
sysfs
sysv
tracefs	tracefs: Have tracefs directories not set OTH permission bits by default	2021-11-18 14:03:56 +01:00
ubifs	treewide: Change list_sort to use const pointers	2021-09-30 10:11:04 +02:00
udf	udf: Fix crash after seekdir	2021-11-26 10:39:20 +01:00
ufs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
unicode
vboxsf	vboxfs: fix broken legacy mount signature checking	2021-10-17 10:43:33 +02:00
verity	fs-verity: fix signed integer overflow with i_size near S64_MAX	2021-10-06 15:55:46 +02:00
xfs	treewide: Change list_sort to use const pointers	2021-09-30 10:11:04 +02:00
zonefs	zonefs: fix to update .i_wr_refcnt correctly in zonefs_open_zone()	2021-03-25 09:04:05 +01:00
aio.c	vfs: separate __sb_start_write into blocking and non-blocking helpers	2020-11-10 16:53:07 -08:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf.c	elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings	2021-10-06 15:55:59 +02:00
binfmt_elf_fdpic.c	binfmt_elf, binfmt_elf_fdpic: use a VMA list snapshot	2020-10-16 11:11:21 -07:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c	binfmt_misc: fix possible deadlock in bm_register_write	2021-03-17 17:06:35 +01:00
binfmt_script.c
block_dev.c	block: fix a race between del_gendisk and BLKRRPART	2021-06-03 09:00:45 +02:00
buffer.c	mm, memcg: rework remote charging API to support nesting	2020-10-18 09:27:09 -07:00
char_dev.c
compat_binfmt_elf.c
coredump.c	coredump: fix memleak in dump_vma_snapshot()	2021-09-26 14:08:56 +02:00
d_path.c	fs: fix NULL dereference due to data race in prepend_path()	2020-10-14 14:54:45 -07:00
dax.c	dax: fix ENOMEM handling in grab_mapping_entry()	2021-07-14 16:56:13 +02:00
dcache.c
dcookies.c
direct-io.c	fs: direct-io: fix missing sdio->boundary	2021-04-14 08:41:58 +02:00
drop_caches.c
eventfd.c
eventpoll.c	fs/epoll: restore waking from ep_done_scan()	2021-05-11 14:47:12 +02:00
exec.c	Revert "Add a reference to ucounts for each cred"	2021-09-08 08:49:00 +02:00
fcntl.c	fcntl: fix potential deadlock for &fasync_struct.fa_lock	2021-09-15 09:50:27 +02:00
fhandle.c
file.c	fget: check that the fd still exists after getting a ref to it	2021-12-08 09:03:21 +01:00
file_table.c	task_work: cleanup notification modes	2020-10-17 15:05:30 -06:00
filesystems.c
fs-writeback.c	writeback: fix obtain a reference to a freeing memcg css	2021-07-14 16:56:31 +02:00
fs_context.c
fs_parser.c	fs_parse: mark fs_param_bad_value() as static	2020-10-13 18:38:27 -07:00
fs_pin.c
fs_struct.c
fs_types.c
fsopen.c
init.c
inode.c	fs: export an inode_update_time helper	2021-11-26 10:39:22 +01:00
internal.h	cgroup1: fix leaked context root causing sporadic NULL deref in LTP	2021-07-31 08:16:11 +02:00
io-wq.c	io-wq: fix wakeup race when adding new work	2021-09-18 13:40:06 +02:00
io-wq.h	io_uring: always batch cancel in *cancel_files()	2021-02-13 13:54:56 +01:00
io_uring.c	Revert "io_uring: reinforce cancel on flush during exit"	2021-11-06 14:10:08 +01:00
ioctl.c
Kconfig	tmpfs: disallow CONFIG_TMPFS_INODE64 on alpha	2021-02-17 11:02:21 +01:00
Kconfig.binfmt
kernel_read_file.c	vfs: check fd has read access in kernel_read_file_from_fd()	2021-10-27 09:56:51 +02:00
libfs.c	libfs: fix error cast of negative value in simple_attr_write()	2020-11-22 10:48:22 -08:00
locks.c	Revert "nfsd4: a client's own opens needn't prevent delegations"	2021-03-20 10:43:44 +01:00
Makefile	Refactored code for 5.10:	2020-10-23 11:33:41 -07:00
mbcache.c
mount.h
mpage.c
namei.c	LOOKUP_MOUNTPOINT: we are cleaning "jumped" flag too late	2021-04-14 08:41:58 +02:00
namespace.c	fs: warn about impending deprecation of mandatory locks	2021-08-26 08:35:57 -04:00
no-block.c
nsfs.c
open.c	open: don't silently ignore unknown O-flags in openat2()	2021-07-14 16:55:59 +02:00
pipe.c	pipe: do FASYNC notifications for every pipe IO, not just state changes	2021-09-03 10:09:28 +02:00
pnode.c
pnode.h	mount: fix mounting of detached mounts onto targets that reside on shared mounts	2021-03-17 17:06:13 +01:00
posix_acl.c
proc_namespace.c	proc mountinfo: make splice available again	2020-12-30 11:54:02 +01:00
read_write.c	Refactored code for 5.10:	2020-10-23 11:33:41 -07:00
readdir.c	readdir: make sure to verify directory entry for legacy interfaces too	2021-04-21 13:00:54 +02:00
remap_range.c	vfs: move the remap range helpers to remap_range.c	2020-10-15 09:48:49 -07:00
select.c	kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()	2021-03-25 09:04:16 +01:00
seq_file.c	seq_file: disallow extremely large seq buffer allocations	2021-07-20 16:05:59 +02:00
signalfd.c
splice.c	io_uring-5.10-2020-10-24	2020-10-24 12:40:18 -07:00
stack.c
stat.c	fs: fix reporting supported extra file attributes for statx()	2021-05-11 14:47:33 +02:00
statfs.c
super.c	vfs: move __sb_{start,end}_write* to fs.h	2020-11-10 16:53:11 -08:00
sync.c
timerfd.c
userfaultfd.c	userfaultfd: fix a race between writeprotect and exit_mmap()	2021-10-27 09:56:51 +02:00
utimes.c
xattr.c	fs/xattr.c: fix kernel-doc warnings for setxattr & removexattr	2020-10-13 18:38:27 -07:00