64 lines
2.0 KiB
Diff
64 lines
2.0 KiB
Diff
From: "Darrick J. Wong" <darrick.wong@oracle.com>
|
|
Date: Thu, 22 Aug 2019 20:55:28 -0700
|
|
Subject: xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT
|
|
Origin: https://git.kernel.org/linus/1fb254aa983bf190cfd685d40c64a480a9bafaee
|
|
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-15538
|
|
|
|
Benjamin Moody reported to Debian that XFS partially wedges when a chgrp
|
|
fails on account of being out of disk quota. I ran his reproducer
|
|
script:
|
|
|
|
# adduser dummy
|
|
# adduser dummy plugdev
|
|
|
|
# dd if=/dev/zero bs=1M count=100 of=test.img
|
|
# mkfs.xfs test.img
|
|
# mount -t xfs -o gquota test.img /mnt
|
|
# mkdir -p /mnt/dummy
|
|
# chown -c dummy /mnt/dummy
|
|
# xfs_quota -xc 'limit -g bsoft=100k bhard=100k plugdev' /mnt
|
|
|
|
(and then as user dummy)
|
|
|
|
$ dd if=/dev/urandom bs=1M count=50 of=/mnt/dummy/foo
|
|
$ chgrp plugdev /mnt/dummy/foo
|
|
|
|
and saw:
|
|
|
|
================================================
|
|
WARNING: lock held when returning to user space!
|
|
5.3.0-rc5 #rc5 Tainted: G W
|
|
------------------------------------------------
|
|
chgrp/47006 is leaving the kernel with locks still held!
|
|
1 lock held by chgrp/47006:
|
|
#0: 000000006664ea2d (&xfs_nondir_ilock_class){++++}, at: xfs_ilock+0xd2/0x290 [xfs]
|
|
|
|
...which is clearly caused by xfs_setattr_nonsize failing to unlock the
|
|
ILOCK after the xfs_qm_vop_chown_reserve call fails. Add the missing
|
|
unlock.
|
|
|
|
Reported-by: benjamin.moody@gmail.com
|
|
Fixes: 253f4911f297 ("xfs: better xfs_trans_alloc interface")
|
|
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
|
|
Reviewed-by: Dave Chinner <dchinner@redhat.com>
|
|
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
|
|
---
|
|
fs/xfs/xfs_iops.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
|
|
index ff3c1fae5357..fe285d123d69 100644
|
|
--- a/fs/xfs/xfs_iops.c
|
|
+++ b/fs/xfs/xfs_iops.c
|
|
@@ -793,6 +793,7 @@ xfs_setattr_nonsize(
|
|
|
|
out_cancel:
|
|
xfs_trans_cancel(tp);
|
|
+ xfs_iunlock(ip, XFS_ILOCK_EXCL);
|
|
out_dqrele:
|
|
xfs_qm_dqrele(udqp);
|
|
xfs_qm_dqrele(gdqp);
|
|
--
|
|
2.23.0
|
|
|