From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793207571; b=slkEAQfQRsgEFB3HEia2IvH6HcGX+zgVH1z2aPYyHEHFE8fTrk7cw/4vIO5UV/iX8Ut7 0KxGuEggDnAlksErt3ZdSgdh35wW0DPJEPB3slBie3rfmZzD+3eSa9uYyaUkUgWoUg2Cc 1nDH17Grnm9YPUjEpop8fW9BEWmd+c0V90eySYXE2MCwMxNXEXRHrDPxgTO4wVHpM78NF /4xU/ZNa1vgvlFgUphNhGyxhN67JVcuXw5GJ32B2nMzXlRfN13m5R4BL+VNyGyEPhCw7P T/dTqVuq5Tqv57z64jjestY1gR6IGYZjI1zRY8sMHQrlQAtAJ12Ev2uO1vo5/Z53mgQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793207571; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=7DzuO4Sf6HqqwrInby43DD8QKTidubN2uL9hSb2nlFM=; b=QSiCUWBg1MdSF2NoB4spIAA47CGIfr4RDtxgMp2orszLsgKqBoKrNTypajDuBZWOYzRZ QqaD8wcWkEkTMRFw72zLrW5+gWMwgWyuVxLgorQ/HygsdvyI6LG4hxhBWVhVHp7kOvfwE ORS6h2Dpa+PKT9fZ5U5BV+ODp7Y62OUNiOahkpQTmSc11Px2p7+tmmrtKLLaEUC+Z/ImA zDXz0U55DwohM8ZOU8C2ji8msP1R10UpohR4qq+3X4PIMo3FlrL7yvrPx3bsbVr6MDqQA sRLXIEj9Hzt2HRYDnk9nkfLQqBhhJXWO0CB+SdFAhGq6Yr6mOuicGLb1lDLujnV/YEg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=J9G92JVC; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B674606A31A; Wed, 28 Oct 2026 17:12:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=J9G92JVC Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4D7501F01825; Wed, 28 Oct 2026 17:12:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793207570; bh=7DzuO4Sf6HqqwrInby43DD8QKTidubN2uL9hSb2nlFM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=J9G92JVCdmw52Wv4+AA4r1qSkia1UY5uF9BuH+5Ua4+An0OlLWWAaPjZBAmdl6K2P Xj5Wbyuji0AL1NK1KOloEqy2ni8m4ArZpSTL+XJZQkIGDoWwQk7iEY1znB2UMUAKMJ q8Oj2QHWnSamx8WuDmyQpQDGp5G0OC7ceJy/kcJQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Sung Byeongchan , Ian Kent , "Christian Brauner (Amutable)" Subject: [PATCH 6.12 063/247] autofs: ignore notification errors from a replaced pipe Date: Wed, 28 Oct 2026 17:57:46 +0100 Message-ID: <20261028165948.875589967@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028165947.349197979@linuxfoundation.org> References: <20261028165947.349197979@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sung Byeongchan commit 65676cd4203c0e41a94caf54080a7f0a95434bda upstream. autofs_notify_daemon() takes a reference to the current notification pipe under wq_mutex, then drops the mutex before writing the request. The write can block while the daemon enters catatonic mode and installs a replacement pipe. If the old pipe's reader is then closed, the delayed write returns -EPIPE and the generic error path enters catatonic mode again. That transition acts on the current superblock state, closes the replacement pipe, and releases the new daemon generation's wait queues. Only enter catatonic mode when the pipe which failed is still the current pipe. Factor the already-locked transition so the identity check and state change are atomic with respect to another replacement. This was reproduced on v7.3-rc5-337-gff47652a4b66c in a local QEMU guest. An unprivileged UID 65534 lookup filled the old packet pipe before a normal CATATONIC/SETPIPEFD restart. On the unmodified kernel, the new pipe received HUP and both a pending victim lookup and a later lookup failed with ENOENT in two out of two fresh-mount runs. With this change, the new pipe remained active, received an intact 304-byte request, and both victim lookups completed in two out of two runs. Normal lookup and restart-without-a-blocked-writer controls passed. No KASAN, oops, refcount, or lock diagnostic was observed. A source reproducer and complete local logs are available privately on request. The demonstrated impact is limited to denial of a shared autofs service during a legitimate daemon restart. No memory corruption, information leak, privilege escalation, or code execution primitive was observed. Fixes: 8d7b48e0bc5fa ("autofs4: add miscellaneous device for ioctls") Cc: stable@vger.kernel.org Signed-off-by: Sung Byeongchan Link: https://patch.msgid.link/20261007173542.593624-1-tjdqudcks0424@naver.com Acked-by: Ian Kent Signed-off-by: Christian Brauner (Amutable) Signed-off-by: Greg Kroah-Hartman --- fs/autofs/waitq.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) --- a/fs/autofs/waitq.c +++ b/fs/autofs/waitq.c @@ -12,15 +12,13 @@ */ static autofs_wqt_t autofs_next_wait_queue = 1; -void autofs_catatonic_mode(struct autofs_sb_info *sbi) +static void autofs_catatonic_mode_locked(struct autofs_sb_info *sbi) { struct autofs_wait_queue *wq, *nwq; - mutex_lock(&sbi->wq_mutex); - if (sbi->flags & AUTOFS_SBI_CATATONIC) { - mutex_unlock(&sbi->wq_mutex); + lockdep_assert_held(&sbi->wq_mutex); + if (sbi->flags & AUTOFS_SBI_CATATONIC) return; - } pr_debug("entering catatonic mode\n"); @@ -40,6 +38,21 @@ void autofs_catatonic_mode(struct autofs fput(sbi->pipe); /* Close the pipe */ sbi->pipe = NULL; sbi->pipefd = -1; +} + +void autofs_catatonic_mode(struct autofs_sb_info *sbi) +{ + mutex_lock(&sbi->wq_mutex); + autofs_catatonic_mode_locked(sbi); + mutex_unlock(&sbi->wq_mutex); +} + +static void autofs_catatonic_mode_for_pipe(struct autofs_sb_info *sbi, + struct file *pipe) +{ + mutex_lock(&sbi->wq_mutex); + if (sbi->pipe == pipe) + autofs_catatonic_mode_locked(sbi); mutex_unlock(&sbi->wq_mutex); } @@ -170,7 +183,7 @@ static void autofs_notify_daemon(struct autofs_wait_release(sbi, wq->wait_queue_token, ret); break; default: - autofs_catatonic_mode(sbi); + autofs_catatonic_mode_for_pipe(sbi, pipe); break; } fput(pipe);