[PATCH 0/8] fs: fix a range of UAFs during rcu pathwalk caused by non-rcu frees

[Christian Brauner <brauner@kernel.org>]

While working on eliding the grace period in namespace_unlock() I went
through what filesystems free when they're shut down and what a pathwalk
in rcu mode can still read at that point. Since 66a97c2ec953's rcu
pathwalk fixes that's the filesystem's job. Whatever ->permission(),
->d_revalidate(), ->get_link(), ->d_hash() and ->d_compare() look at in
rcu mode has to be freed after a grace period. A few filesystems don't
do that.

Most of it is hidden by umount(2). namespace_unlock() waits for a grace
period before it drops the mounts, so a walker that was inside the
filesystem is gone by the time the filesystem is shut down.

But the last reference to a mount doesn't have to go away in umount(2).
A chdir() out of a lazily unmounted directory or the close() of the last
file on it drops it without a grace period. A walker can then still be
in the filesystem while ->put_super() and ->kill_sb() free what it
reads.

With KASAN on vfs.fixes:

- ext4_get_link() reads sb->s_fs_info and the extent status counters in
  rcu mode for a symlink that keeps its target in a data block.

  ext4_put_super() destroys the counters, clears s_fs_info and frees the
  sbi right away. That's a NULL dereference, a use-after-free of the sbi
  or a fault on a destroyed percpu counter, depending on where the
  walker sits.

- The unicode map of casefolded ext4, f2fs and tmpfs is freed from
  ->put_super() while generic_ci_d_hash() and generic_ci_d_compare() use
  it.

- ntfs3 with nocase frees its sbi and mount options under ntfs_d_hash()
  and ntfs_d_compare(). A remount frees the old mount options right away
  too, that one needs no unmount at all.

- eventfs frees an eventfs_inode after an SRCU grace period only, but
  tracefs_d_revalidate() reads it under rcu_read_lock(). No unmount
  needed either.

The ipc patch is a different kind of bug. create_ipc_ns() leaks the
mqueue mount and its superblock when it fails after mq_init_ns(). I ran
into it while looking at the kern_unmount() users.

afs and 9p look just as broken but nothing can reach it today. Both
have a private bdi, and generic_shutdown_super() calls bdi_unregister(),
which waits for a grace period before ->kill_sb() frees their private
data. That grace period is there for the rcu readers of bdi_list and
covers afs and 9p by accident. I don't want them to depend on that, so
they free their private data after a grace period of their own as well.

I appended the reproducers. The race reproducers hold a pathwalk inside
the filesystem's callback for two seconds with a kprobe while the other
side frees what it reads. For the ntfs3 remount the window is a single
load and its dereference, so that one needs an mdelay() in the kernel.
ext4 with a journal needs a kernel without lockdep since
jbd2_journal_destroy() calls lockdep_unregister_key(), which waits for a
grace period too.

Clean this all up.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
Christian Brauner (8):
      ext4: free the sbi after a grace period
      afs: free the super info after a grace period
      9p: free the session after a grace period
      eventfs: free the eventfs_inode after an rcu grace period too
      ipc: drop the mqueue mount with kern_unmount() on setup failure
      unicode: free the map after a grace period
      ntfs3: free the sbi after a grace period
      ntfs3: free replaced mount options after a grace period

 fs/9p/v9fs.h             |  1 +
 fs/9p/vfs_super.c        |  4 ++--
 fs/afs/internal.h        |  2 ++
 fs/afs/super.c           |  2 +-
 fs/ext4/ext4.h           |  2 ++
 fs/ext4/extents-test.c   |  2 ++
 fs/ext4/extents.c        |  1 +
 fs/ext4/extents_status.c |  7 ++++++-
 fs/ext4/extents_status.h |  1 +
 fs/ext4/super.c          | 13 +++++++++++--
 fs/ntfs3/dir.c           | 13 +++++++++++--
 fs/ntfs3/ntfs_fs.h       |  3 +++
 fs/ntfs3/super.c         | 49 +++++++++++++++++++++++++++++++++++-------------
 fs/tracefs/event_inode.c | 10 +++++++++-
 fs/unicode/utf8-core.c   | 21 +++++++++++++++++----
 include/linux/unicode.h  |  1 +
 ipc/namespace.c          |  2 +-
 17 files changed, 107 insertions(+), 27 deletions(-)
---
base-commit: 3d399224425573875b6f6f1181bd8cf9a28cc7d1
change-id: 20261009-work-fixes-rcu-cd9c1eec0769