erofs: fix use-after-free of fsid and domain_id string

When erofs instance is remounted with fsid or domain_id mount option
specified, the original fsid and domain_id string pointer in sbi->opt
is directly overridden with the fsid and domain_id string in the new
fs_context, without freeing the original fsid and domain_id string.
What's worse, when the new fsid and domain_id string is transferred to
sbi, they are not reset to NULL in fs_context, and thus they are freed
when remount finishes, while sbi is still referring to these strings.

Reconfiguration for fsid and domain_id seems unusual. Thus clarify this
restriction explicitly and dump a warning when users are attempting to
do this.

Besides, to fix the use-after-free issue, move fsid and domain_id from
erofs_mount_opts to outside.

Fixes: c6be2bd0a5dd ("erofs: register fscache volume")
Fixes: 8b7adf1dff3d ("erofs: introduce fscache-based domain")
Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Reviewed-by: Jia Zhu <zhujia.zj@bytedance.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Link: https://lore.kernel.org/r/20221021023153.1330-1-jefflexu@linux.alibaba.com
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>

diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c
index 260fa4737fc006b9b2d646d94a24ec37ea079e95..6eaf4a4ab95ca1ec669a5481327e390e4849c29d 100644 (file)
--- a/fs/erofs/fscache.c
+++ b/fs/erofs/fscache.c
@@ -406,13 +406,13 @@ static void erofs_fscache_domain_put(struct erofs_domain *domain)
 static int erofs_fscache_register_volume(struct super_block *sb)
 {
        struct erofs_sb_info *sbi = EROFS_SB(sb);
-       char *domain_id = sbi->opt.domain_id;
+       char *domain_id = sbi->domain_id;
        struct fscache_volume *volume;
        char *name;
        int ret = 0;
 
        name = kasprintf(GFP_KERNEL, "erofs,%s",
-                        domain_id ? domain_id : sbi->opt.fsid);
+                        domain_id ? domain_id : sbi->fsid);
        if (!name)
                return -ENOMEM;
 
@@ -438,7 +438,7 @@ static int erofs_fscache_init_domain(struct super_block *sb)
        if (!domain)
                return -ENOMEM;
 
-       domain->domain_id = kstrdup(sbi->opt.domain_id, GFP_KERNEL);
+       domain->domain_id = kstrdup(sbi->domain_id, GFP_KERNEL);
        if (!domain->domain_id) {
                kfree(domain);
                return -ENOMEM;
@@ -475,7 +475,7 @@ static int erofs_fscache_register_domain(struct super_block *sb)
 
        mutex_lock(&erofs_domain_list_lock);
        list_for_each_entry(domain, &erofs_domain_list, list) {
-               if (!strcmp(domain->domain_id, sbi->opt.domain_id)) {
+               if (!strcmp(domain->domain_id, sbi->domain_id)) {
                        sbi->domain = domain;
                        sbi->volume = domain->volume;
                        refcount_inc(&domain->ref);
@@ -612,7 +612,7 @@ struct erofs_fscache *erofs_domain_register_cookie(struct super_block *sb,
 struct erofs_fscache *erofs_fscache_register_cookie(struct super_block *sb,
                                                    char *name, bool need_inode)
 {
-       if (EROFS_SB(sb)->opt.domain_id)
+       if (EROFS_SB(sb)->domain_id)
                return erofs_domain_register_cookie(sb, name, need_inode);
        return erofs_fscache_acquire_cookie(sb, name, need_inode);
 }
@@ -644,7 +644,7 @@ int erofs_fscache_register_fs(struct super_block *sb)
        struct erofs_sb_info *sbi = EROFS_SB(sb);
        struct erofs_fscache *fscache;
 
-       if (sbi->opt.domain_id)
+       if (sbi->domain_id)
                ret = erofs_fscache_register_domain(sb);
        else
                ret = erofs_fscache_register_volume(sb);
@@ -652,7 +652,7 @@ int erofs_fscache_register_fs(struct super_block *sb)
                return ret;
 
        /* acquired domain/volume will be relinquished in kill_sb() on error */
-       fscache = erofs_fscache_register_cookie(sb, sbi->opt.fsid, true);
+       fscache = erofs_fscache_register_cookie(sb, sbi->fsid, true);
        if (IS_ERR(fscache))
                return PTR_ERR(fscache);
 

diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h
index 1701df48c4464977d8e0524024ce42ff55985914..05dc686277220e3f822a89ca036af82bed2ff063 100644 (file)
--- a/fs/erofs/internal.h
+++ b/fs/erofs/internal.h
@@ -75,8 +75,6 @@ struct erofs_mount_opts {
        unsigned int max_sync_decompress_pages;
 #endif
        unsigned int mount_opt;
-       char *fsid;
-       char *domain_id;
 };
 
 struct erofs_dev_context {
@@ -89,6 +87,8 @@ struct erofs_dev_context {
 struct erofs_fs_context {
        struct erofs_mount_opts opt;
        struct erofs_dev_context *devs;
+       char *fsid;
+       char *domain_id;
 };
 
 /* all filesystem-wide lz4 configurations */
@@ -170,6 +170,8 @@ struct erofs_sb_info {
        struct fscache_volume *volume;
        struct erofs_fscache *s_fscache;
        struct erofs_domain *domain;
+       char *fsid;
+       char *domain_id;
 };
 
 #define EROFS_SB(sb) ((struct erofs_sb_info *)(sb)->s_fs_info)

diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index 2cf96ce1c32eed444fbf89f4aa90e4f79fbee42c..1c7dcca702b3e3ff96df72a35e54869f3bb8d460 100644 (file)
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -579,9 +579,9 @@ static int erofs_fc_parse_param(struct fs_context *fc,
                break;
        case Opt_fsid:
 #ifdef CONFIG_EROFS_FS_ONDEMAND
-               kfree(ctx->opt.fsid);
-               ctx->opt.fsid = kstrdup(param->string, GFP_KERNEL);
-               if (!ctx->opt.fsid)
+               kfree(ctx->fsid);
+               ctx->fsid = kstrdup(param->string, GFP_KERNEL);
+               if (!ctx->fsid)
                        return -ENOMEM;
 #else
                errorfc(fc, "fsid option not supported");
@@ -589,9 +589,9 @@ static int erofs_fc_parse_param(struct fs_context *fc,
                break;
        case Opt_domain_id:
 #ifdef CONFIG_EROFS_FS_ONDEMAND
-               kfree(ctx->opt.domain_id);
-               ctx->opt.domain_id = kstrdup(param->string, GFP_KERNEL);
-               if (!ctx->opt.domain_id)
+               kfree(ctx->domain_id);
+               ctx->domain_id = kstrdup(param->string, GFP_KERNEL);
+               if (!ctx->domain_id)
                        return -ENOMEM;
 #else
                errorfc(fc, "domain_id option not supported");
@@ -728,10 +728,12 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
 
        sb->s_fs_info = sbi;
        sbi->opt = ctx->opt;
-       ctx->opt.fsid = NULL;
-       ctx->opt.domain_id = NULL;
        sbi->devs = ctx->devs;
        ctx->devs = NULL;
+       sbi->fsid = ctx->fsid;
+       ctx->fsid = NULL;
+       sbi->domain_id = ctx->domain_id;
+       ctx->domain_id = NULL;
 
        if (erofs_is_fscache_mode(sb)) {
                sb->s_blocksize = EROFS_BLKSIZ;
@@ -820,7 +822,7 @@ static int erofs_fc_get_tree(struct fs_context *fc)
 {
        struct erofs_fs_context *ctx = fc->fs_private;
 
-       if (IS_ENABLED(CONFIG_EROFS_FS_ONDEMAND) && ctx->opt.fsid)
+       if (IS_ENABLED(CONFIG_EROFS_FS_ONDEMAND) && ctx->fsid)
                return get_tree_nodev(fc, erofs_fc_fill_super);
 
        return get_tree_bdev(fc, erofs_fc_fill_super);
@@ -834,6 +836,9 @@ static int erofs_fc_reconfigure(struct fs_context *fc)
 
        DBG_BUGON(!sb_rdonly(sb));
 
+       if (ctx->fsid || ctx->domain_id)
+               erofs_info(sb, "ignoring reconfiguration for fsid|domain_id.");
+
        if (test_opt(&ctx->opt, POSIX_ACL))
                fc->sb_flags |= SB_POSIXACL;
        else
@@ -873,8 +878,8 @@ static void erofs_fc_free(struct fs_context *fc)
        struct erofs_fs_context *ctx = fc->fs_private;
 
        erofs_free_dev_context(ctx->devs);
-       kfree(ctx->opt.fsid);
-       kfree(ctx->opt.domain_id);
+       kfree(ctx->fsid);
+       kfree(ctx->domain_id);
        kfree(ctx);
 }
 
@@ -944,8 +949,8 @@ static void erofs_kill_sb(struct super_block *sb)
        erofs_free_dev_context(sbi->devs);
        fs_put_dax(sbi->dax_dev, NULL);
        erofs_fscache_unregister_fs(sb);
-       kfree(sbi->opt.fsid);
-       kfree(sbi->opt.domain_id);
+       kfree(sbi->fsid);
+       kfree(sbi->domain_id);
        kfree(sbi);
        sb->s_fs_info = NULL;
 }
@@ -1098,10 +1103,10 @@ static int erofs_show_options(struct seq_file *seq, struct dentry *root)
        if (test_opt(opt, DAX_NEVER))
                seq_puts(seq, ",dax=never");
 #ifdef CONFIG_EROFS_FS_ONDEMAND
-       if (opt->fsid)
-               seq_printf(seq, ",fsid=%s", opt->fsid);
-       if (opt->domain_id)
-               seq_printf(seq, ",domain_id=%s", opt->domain_id);
+       if (sbi->fsid)
+               seq_printf(seq, ",fsid=%s", sbi->fsid);
+       if (sbi->domain_id)
+               seq_printf(seq, ",domain_id=%s", sbi->domain_id);
 #endif
        return 0;
 }

diff --git a/fs/erofs/sysfs.c b/fs/erofs/sysfs.c
index 783bb7b21b514a67a9da748c786e59c8ab6522db..fd476961f742f074359033d4752ebc96480e1d10 100644 (file)
--- a/fs/erofs/sysfs.c
+++ b/fs/erofs/sysfs.c
@@ -210,14 +210,14 @@ int erofs_register_sysfs(struct super_block *sb)
        int err;
 
        if (erofs_is_fscache_mode(sb)) {
-               if (sbi->opt.domain_id) {
-                       str = kasprintf(GFP_KERNEL, "%s,%s", sbi->opt.domain_id,
-                                       sbi->opt.fsid);
+               if (sbi->domain_id) {
+                       str = kasprintf(GFP_KERNEL, "%s,%s", sbi->domain_id,
+                                       sbi->fsid);
                        if (!str)
                                return -ENOMEM;
                        name = str;
                } else {
-                       name = sbi->opt.fsid;
+                       name = sbi->fsid;
                }
        } else {
                name = sb->s_id;