[PATCH] fs/namei: fix UAF in pick_link() by unlazying before atime check

[PATCH] fs/namei: fix UAF in pick_link() by unlazying before atime check

[Deepanshu Kartikey]

In pick_link(), atime_needs_update() is called while the path walk
may still be in RCU mode (LOOKUP_RCU set), meaning no reference is
held on the inode. A concurrent iput() from another task can free
the inode while atime_needs_update() reads inode->i_opflags (offset
+2) inside current_time() -> is_mgtime(), causing a use-after-free.

KASAN reports:
  BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313
  Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags)

The race:
  Task A (pick_link)             Task B (unlinkat)
  ------------------             -----------------
  atime_needs_update(inode)      iput(inode)
    current_time(inode)            evict()
      is_mgtime(inode)               destroy_inode()
        inode->i_opflags  UAF          inode FREED

Fix: call try_to_unlazy() before atime_needs_update() so that
a proper inode reference is held before any inode fields are read.
If try_to_unlazy() detects the inode is already gone, it returns
false and we exit safely with -ECHILD without touching freed memory.

Fixes: e45960c279b098ebc0c2 ("fs: unconditionally use atime_needs_update() in pick_link()")
Reported-by: syzbot+36e50496c8ac4bcde3f9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=36e50496c8ac4bcde3f9
Tested-by: syzbot+36e50496c8ac4bcde3f9@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 fs/namei.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/namei.c b/fs/namei.c
index c7fac83c9a85..eac0ec35be37 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2037,11 +2037,11 @@ static noinline const char *pick_link(struct nameidata *nd, struct path *link,
 			unlikely(link->mnt->mnt_flags & MNT_NOSYMFOLLOW))
 		return ERR_PTR(-ELOOP);
 
+	if (nd->flags & LOOKUP_RCU) {
+		if (!try_to_unlazy(nd))
+			return ERR_PTR(-ECHILD);
+	}
 	if (unlikely(atime_needs_update(&last->link, inode))) {
-		if (nd->flags & LOOKUP_RCU) {
-			if (!try_to_unlazy(nd))
-				return ERR_PTR(-ECHILD);
-		}
 		touch_atime(&last->link);
 		cond_resched();
 	}
-- 
2.43.0

Re: [PATCH] fs/namei: fix UAF in pick_link() by unlazying before atime check

[Al Viro]

On Tue, Jun 02, 2026 at 05:56:07AM +0530, Deepanshu Kartikey wrote:
> In pick_link(), atime_needs_update() is called while the path walk
> may still be in RCU mode (LOOKUP_RCU set), meaning no reference is
> held on the inode. A concurrent iput() from another task can free
> the inode while atime_needs_update() reads inode->i_opflags (offset
> +2) inside current_time() -> is_mgtime(), causing a use-after-free.
> 
> KASAN reports:
>   BUG: KASAN: slab-use-after-free in is_mgtime include/linux/fs.h:2313
>   Read of size 2 at addr ffff8880407e4282 (offset +2 = i_opflags)
> 
> The race:
>   Task A (pick_link)             Task B (unlinkat)
>   ------------------             -----------------
>   atime_needs_update(inode)      iput(inode)
>     current_time(inode)            evict()
>       is_mgtime(inode)               destroy_inode()
>         inode->i_opflags  UAF          inode FREED
> 
> Fix: call try_to_unlazy() before atime_needs_update() so that
> a proper inode reference is held before any inode fields are read.
> If try_to_unlazy() detects the inode is already gone, it returns
> false and we exit safely with -ECHILD without touching freed memory.

NAK.  This is *not* fixing the real problem; it's papering over the
real breakage.  At a guess - in bpffs, if that's the same thing as
in https://lore.kernel.org/all/20260423043906.GN3518998@ZenIV/

Prompt freeing of inode is allowed *ONLY* if inode is never exposed
to lazy pathwalk.  It's OK for pipes, but this is not a pipe.

Re: [PATCH] fs/namei: fix UAF in pick_link() by unlazying before atime check

[Deepanshu Kartikey]

On Tue, Jun 2, 2026 at 6:13 AM Al Viro <viro@zeniv.linux.org.uk> wrote:
>
> NAK.  This is *not* fixing the real problem; it's papering over the
> real breakage.  At a guess - in bpffs, if that's the same thing as
> in https://lore.kernel.org/all/20260423043906.GN3518998@ZenIV/
>
> Prompt freeing of inode is allowed *ONLY* if inode is never exposed
> to lazy pathwalk.  It's OK for pipes, but this is not a pipe.

Thanks for the suggestion. I will send patch v2 with the required changes.

Thanks
Deepanshu