fsnotify: Fix ordering of iput() and watched_objects decrement

Ensure the superblock is kept alive until we're done with iput().
Holding a reference to an inode is not allowed unless we ensure the
superblock stays alive, which fsnotify does by keeping the
watched_objects count elevated, so iput() must happen before the
watched_objects decrement.
This can lead to a UAF of something like sb->s_fs_info in tmpfs, but the
UAF is hard to hit because race orderings that oops are more likely, thanks
to the CHECK_DATA_CORRUPTION() block in generic_shutdown_super().

Also, ensure that fsnotify_put_sb_watched_objects() doesn't call
fsnotify_sb_watched_objects() on a superblock that may have already been
freed, which would cause a UAF read of sb->s_fsnotify_info.

Cc: [email protected]
Fixes: d2f277e26f52 ("fsnotify: rename fsnotify_{get,put}_sb_connectors()")
Signed-off-by: Jann Horn <[email protected]>
Signed-off-by: Jan Kara <[email protected]>

diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index c45b222cf9c11c5479016fdbb8b0b90de699a63b..4981439e62092a0acb5d92461b7f4a905a611c5f 100644 (file)
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -138,8 +138,11 @@ static void fsnotify_get_sb_watched_objects(struct super_block *sb)
 
 static void fsnotify_put_sb_watched_objects(struct super_block *sb)
 {
-       if (atomic_long_dec_and_test(fsnotify_sb_watched_objects(sb)))
-               wake_up_var(fsnotify_sb_watched_objects(sb));
+       atomic_long_t *watched_objects = fsnotify_sb_watched_objects(sb);
+
+       /* the superblock can go away after this decrement */
+       if (atomic_long_dec_and_test(watched_objects))
+               wake_up_var(watched_objects);
 }
 
 static void fsnotify_get_inode_ref(struct inode *inode)
@@ -150,8 +153,11 @@ static void fsnotify_get_inode_ref(struct inode *inode)
 
 static void fsnotify_put_inode_ref(struct inode *inode)
 {
-       fsnotify_put_sb_watched_objects(inode->i_sb);
+       /* read ->i_sb before the inode can go away */
+       struct super_block *sb = inode->i_sb;
+
        iput(inode);
+       fsnotify_put_sb_watched_objects(sb);
 }
 
 /*