From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793210006; b=kLlkqIsnYalKz5nGozrqkU72c8rhSuCVraP2dkIYc9BxvqBkfuB7B7huxXrozDuH4ukv jrTvJ+2/q3AyGgCFXJ8inlNgD/8bxKFh3qxaugBJ4MxY7wxbLBAbyBMIjSA4ufTIShrgj 4TUU/UlxRexsR4b/vn0MnM6mLS/PZ4oCJaYBAQpOO68Un80KJuFsEEAbVi00rmSwSeKKa 1Tv3BwXzVnoFSySsPhDO8M4BUb3Nv0yZEIyVaR/2/6ku68NxAybj8mqIbBWnHn9PqjAYS 0UR8sXuz4LNytgwOMxNtrHIAuY5k1HilJDTLBgmdurWLF4o7I8TEIGIXYjJhf0mJWcg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793210006; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=2ou7kq+ZTwHvGnSFJ/Efmiioi1aE2F2Yg0uLLBkKONc=; b=q8TbSUEBuUWqw4LtlfaD4U7oSbffyXIzEFhlghgqyMk3ddn0JDFegq25PaY7vAH8WENc c4L4C0yCjcXmtWflY8eTHLhr7ekkscDghXgvAjlmO2bLggJSVURJK1t480J7G0rtoY2Xv 7yV5QpeFshoc7XGwsBp3q7fZh9Yeb1MOzgrRw9yuXEyTQhquKKShXj/m1IXlx2KdIxxxm 1RPxtiaYm8FhlKSPV3X4qD9PgRPLbjnBov80XUQ890+05f/91V0cstoCSyYrEE1P6u1y3 /Sfd1XVnCxNj5MgOKbY8bxBOmNDYF06stahzy9jMfgH5k7X5aHh3K0akOGy9voYtIuQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=UcM7vFpe; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BE441606A31A; Wed, 28 Oct 2026 17:53:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=UcM7vFpe Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6FB51F01825; Wed, 28 Oct 2026 17:53:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793210005; bh=2ou7kq+ZTwHvGnSFJ/Efmiioi1aE2F2Yg0uLLBkKONc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=UcM7vFpeB43vrrTLDEZ1NH+Gxh63nzssQvso3Gm+g9ecGqoQg0u/sc04909qKYYdL jaL5hh2OCEmT56hOIjQnsehPWRreul9Ns0/pcGQkxYFF0jC/UsJShmjvFyLjPUhn/W xFNl3BxqaRpmKTCTOtLGY0Y/5GdeuQJ4zoAxWAXg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Sung Byeongchan , Ian Kent , "Christian Brauner (Amutable)" Subject: [PATCH 6.6 041/168] autofs: ignore notification errors from a replaced pipe Date: Wed, 28 Oct 2026 17:59:37 +0100 Message-ID: <20261028165944.063823570@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028165943.089486480@linuxfoundation.org> References: <20261028165943.089486480@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sung Byeongchan commit 65676cd4203c0e41a94caf54080a7f0a95434bda upstream. autofs_notify_daemon() takes a reference to the current notification pipe under wq_mutex, then drops the mutex before writing the request. The write can block while the daemon enters catatonic mode and installs a replacement pipe. If the old pipe's reader is then closed, the delayed write returns -EPIPE and the generic error path enters catatonic mode again. That transition acts on the current superblock state, closes the replacement pipe, and releases the new daemon generation's wait queues. Only enter catatonic mode when the pipe which failed is still the current pipe. Factor the already-locked transition so the identity check and state change are atomic with respect to another replacement. This was reproduced on v7.3-rc5-337-gff47652a4b66c in a local QEMU guest. An unprivileged UID 65534 lookup filled the old packet pipe before a normal CATATONIC/SETPIPEFD restart. On the unmodified kernel, the new pipe received HUP and both a pending victim lookup and a later lookup failed with ENOENT in two out of two fresh-mount runs. With this change, the new pipe remained active, received an intact 304-byte request, and both victim lookups completed in two out of two runs. Normal lookup and restart-without-a-blocked-writer controls passed. No KASAN, oops, refcount, or lock diagnostic was observed. A source reproducer and complete local logs are available privately on request. The demonstrated impact is limited to denial of a shared autofs service during a legitimate daemon restart. No memory corruption, information leak, privilege escalation, or code execution primitive was observed. Fixes: 8d7b48e0bc5fa ("autofs4: add miscellaneous device for ioctls") Cc: stable@vger.kernel.org Signed-off-by: Sung Byeongchan Link: https://patch.msgid.link/20261007173542.593624-1-tjdqudcks0424@naver.com Acked-by: Ian Kent Signed-off-by: Christian Brauner (Amutable) Signed-off-by: Greg Kroah-Hartman --- fs/autofs/waitq.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) --- a/fs/autofs/waitq.c +++ b/fs/autofs/waitq.c @@ -12,15 +12,13 @@ */ static autofs_wqt_t autofs_next_wait_queue = 1; -void autofs_catatonic_mode(struct autofs_sb_info *sbi) +static void autofs_catatonic_mode_locked(struct autofs_sb_info *sbi) { struct autofs_wait_queue *wq, *nwq; - mutex_lock(&sbi->wq_mutex); - if (sbi->flags & AUTOFS_SBI_CATATONIC) { - mutex_unlock(&sbi->wq_mutex); + lockdep_assert_held(&sbi->wq_mutex); + if (sbi->flags & AUTOFS_SBI_CATATONIC) return; - } pr_debug("entering catatonic mode\n"); @@ -40,6 +38,21 @@ void autofs_catatonic_mode(struct autofs fput(sbi->pipe); /* Close the pipe */ sbi->pipe = NULL; sbi->pipefd = -1; +} + +void autofs_catatonic_mode(struct autofs_sb_info *sbi) +{ + mutex_lock(&sbi->wq_mutex); + autofs_catatonic_mode_locked(sbi); + mutex_unlock(&sbi->wq_mutex); +} + +static void autofs_catatonic_mode_for_pipe(struct autofs_sb_info *sbi, + struct file *pipe) +{ + mutex_lock(&sbi->wq_mutex); + if (sbi->pipe == pipe) + autofs_catatonic_mode_locked(sbi); mutex_unlock(&sbi->wq_mutex); } @@ -170,7 +183,7 @@ static void autofs_notify_daemon(struct autofs_wait_release(sbi, wq->wait_queue_token, ret); break; default: - autofs_catatonic_mode(sbi); + autofs_catatonic_mode_for_pipe(sbi, pipe); break; } fput(pipe);