linux/fs/notify
Amir Goldstein 795bb82d12 fsnotify: fix UAF from FS_ERROR event on a shutting down filesystem
Protect against use after free when filesystem calls fsnotify_sb_error()
during fs shutdown.

Move freeing of sb->s_fsnotify_info to destroy_super_work(), because it
may be accessed from fs shutdown context.

Reported-by: syzbot+5e3f9b2a67b45f16d4e6@syzkaller.appspotmail.com
Suggested-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/linux-fsdevel/20240416173211.4lnmgctyo4jn5fha@quack3/
Fixes: 07a3b8d0bf ("fsnotify: lazy attach fsnotify_sb_info state to sb")
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20240416181452.567070-1-amir73il@gmail.com>
2024-04-17 15:06:50 +02:00
..
dnotify fsnotify: create a wrapper fsnotify_find_inode_mark() 2024-04-04 16:24:16 +02:00
fanotify fsnotify: use an enum for group priority constants 2024-04-04 16:24:16 +02:00
inotify fsnotify: create a wrapper fsnotify_find_inode_mark() 2024-04-04 16:24:16 +02:00
fdinfo.c fsnotify: Avoid -Wflex-array-member-not-at-end warning 2024-03-26 10:53:32 +01:00
fdinfo.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fsnotify.c fsnotify: fix UAF from FS_ERROR event on a shutting down filesystem 2024-04-17 15:06:50 +02:00
fsnotify.h fsnotify: lazy attach fsnotify_sb_info state to sb 2024-04-04 16:24:16 +02:00
group.c fsnotify: create helpers for group mark_mutex lock 2022-04-25 14:37:22 +02:00
Kconfig fs/notify: Remove "select SRCU" 2023-02-02 16:26:06 -08:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mark.c fsnotify: optimize the case of no permission event watchers 2024-04-04 16:24:16 +02:00
notification.c fsnotify: Pass group argument to free_event 2021-10-27 12:34:18 +02:00