| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-46972: ovl: fix leaked dentry |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ovl: fix leaked dentry |
| |
| Since commit 6815f479ca90 ("ovl: use only uppermetacopy state in |
| ovl_lookup()"), overlayfs doesn't put temporary dentry when there is a |
| metacopy error, which leads to dentry leaks when shutting down the related |
| superblock: |
| |
| overlayfs: refusing to follow metacopy origin for (/file0) |
| ... |
| BUG: Dentry (____ptrval____){i=3f33,n=file3} still in use (1) [unmount of overlay overlay] |
| ... |
| WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d |
| CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1 |
| ... |
| RIP: 0010:umount_check.cold+0x107/0x14d |
| ... |
| Call Trace: |
| d_walk+0x28c/0x950 |
| ? dentry_lru_isolate+0x2b0/0x2b0 |
| ? __kasan_slab_free+0x12/0x20 |
| do_one_tree+0x33/0x60 |
| shrink_dcache_for_umount+0x78/0x1d0 |
| generic_shutdown_super+0x70/0x440 |
| kill_anon_super+0x3e/0x70 |
| deactivate_locked_super+0xc4/0x160 |
| deactivate_super+0xfa/0x140 |
| cleanup_mnt+0x22e/0x370 |
| __cleanup_mnt+0x1a/0x30 |
| task_work_run+0x139/0x210 |
| do_exit+0xb0c/0x2820 |
| ? __kasan_check_read+0x1d/0x30 |
| ? find_held_lock+0x35/0x160 |
| ? lock_release+0x1b6/0x660 |
| ? mm_update_next_owner+0xa20/0xa20 |
| ? reacquire_held_locks+0x3f0/0x3f0 |
| ? __sanitizer_cov_trace_const_cmp4+0x22/0x30 |
| do_group_exit+0x135/0x380 |
| __do_sys_exit_group.isra.0+0x20/0x20 |
| __x64_sys_exit_group+0x3c/0x50 |
| do_syscall_64+0x45/0x70 |
| entry_SYSCALL_64_after_hwframe+0x44/0xae |
| ... |
| VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds. Have a nice day... |
| |
| This fix has been tested with a syzkaller reproducer. |
| |
| The Linux kernel CVE team has assigned CVE-2021-46972 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.8 with commit 6815f479ca90ee7fd2e28b2a420f796b974155fe and fixed in 5.10.35 with commit 71d58457a8afc650da5d3292a7f7029317654d95 |
| Issue introduced in 5.8 with commit 6815f479ca90ee7fd2e28b2a420f796b974155fe and fixed in 5.11.19 with commit cf3e3330bc5719fa9d658e3e2f596bde89344a94 |
| Issue introduced in 5.8 with commit 6815f479ca90ee7fd2e28b2a420f796b974155fe and fixed in 5.12.2 with commit d587cfaef72b1b6f4b2774827123bce91f497cc8 |
| Issue introduced in 5.8 with commit 6815f479ca90ee7fd2e28b2a420f796b974155fe and fixed in 5.13 with commit eaab1d45cdb4bb0c846bd23c3d666d5b90af7b41 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-46972 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| fs/overlayfs/namei.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/71d58457a8afc650da5d3292a7f7029317654d95 |
| https://git.kernel.org/stable/c/cf3e3330bc5719fa9d658e3e2f596bde89344a94 |
| https://git.kernel.org/stable/c/d587cfaef72b1b6f4b2774827123bce91f497cc8 |
| https://git.kernel.org/stable/c/eaab1d45cdb4bb0c846bd23c3d666d5b90af7b41 |
