In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ovl: fix double end_creating() on the casefold-mismatch path<\/p>\n
ovl_create_real() releases the new dentry twice when the casefold
\nconsistency check fails. The S_IFDIR branch calls end_creating() and
\nsets err, then falls through to the common out: label which calls
\nend_creating() on the same dentry again:<\/p>\n
\tcase S_IFDIR:
\n\t\tnewdentry = ovl_do_mkdir(ofs, dir, newdentry, attr->mode);
\n\t\terr = PTR_ERR_OR_ZERO(newdentry);
\n\t\tif (!err && ofs->casefold != ovl_dentry_casefolded(newdentry)) {
\n\t\t\tpr_warn_ratelimited(…);
\n\t\t\tend_creating(newdentry);\t\/* first *\/
\n\t\t\terr = -EINVAL;
\n\t\t}
\n\t\tbreak;
\n\t…
\n\tif (err)
\n\t\tgoto out;
\n\t…
\n out:
\n\tif (err) {
\n\t\tend_creating(newdentry);\t\/* second, same dentry *\/
\n\t\treturn ERR_PTR(err);
\n\t}<\/p>\n
end_creating() is end_dirop(), which does inode_unlock() on the parent
\nand dput() on the dentry, so the parent directory’s i_rwsem is unlocked
\ntwice and the dentry is put twice. The second unlock releases a lock
\nthat is not held, which is what wedges every later creation under that
\nparent, and the second dput() drops a reference that was never taken.<\/p>\n
The branch was added by commit dfc7da402ccc (“ovl: Check for casefold
\nconsistency when creating new dentries”) as a bare dput(), which already
\nreleased the reference twice; commit fe497f0759e0 (“VFS: change
\nvfs_mkdir() to unlock on failure.”) converted both sites to
\nend_creating(), adding the double unlock.<\/p>\n
This is reachable by an unprivileged user. The casefold consistency of
\nthe layers is validated at mount time in ovl_parse_layer(), and again on
\nevery lookup in ovl_lookup_single(), but ofs->workdir is the internal
\n“work” subdirectory created inside the user-supplied workdir, and that
\nsubdirectory is not re-checked. Marking it casefolded after the mount
\ntherefore makes every ovl_create_temp() inherit the wrong state – and
\nthat path reaches ovl_create_real() through ovl_start_creating_temp(),
\nwhich uses start_creating() with a generated name and so never runs the
\nlookup-time check.<\/p>\n
unshare -Urm
\n mount -t tmpfs -o casefold=utf8-12.1.0 tmpfs mnt
\n mkdir -p mnt\/lower\/d mnt\/upper mnt\/work mnt\/merged
\n mount -t overlay ovl -o lowerdir=mnt\/lower,
\n upperdir=mnt\/upper,workdir=mnt\/work mnt\/merged
\n chattr +F mnt\/work\/work
\n mkdir mnt\/merged\/d\/sub\t\t# directory copy-up<\/p>\n
overlayfs: wrong inherited casefold (work\/#5)<\/p>\n
and the next copy-up blocks forever on the parent’s i_rwsem:<\/p>\n
mkdir D start_creating+0x65\/0xb0
\n ovl_start_creating_temp+0xb0\/0xe0 [overlay]
\n ovl_create_temp+0xa3\/0x1d0 [overlay]
\n ovl_copy_up_one+0x1f1c\/0x21c0 [overlay]
\n ovl_copy_up_flags+0xf5\/0x140 [overlay]
\n ovl_create_object+0xb7\/0x220 [overlay]
\n ovl_mkdir+0x23\/0x40 [overlay]<\/p>\n
Drop the end_creating() from the branch and let out: own the cleanup,
\nwhich is what every other error path in this function already does.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ovl: fix double end_creating() on the casefold-mismatch path<\/p>\n
ovl_create_real() releases the new dentry twice when the casefold
\ncon<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21689","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21689","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21689"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21689"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21689"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}