Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Lv Yunlong <lyl2019@mail.ustc.edu.cn>
To:     hubcap@omnibond.com, martin@omnibond.com
Cc:     devel@lists.orangefs.org, linux-kernel@vger.kernel.org,
        Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Subject: [PATCH] orangefs: Fix a use after free in purge_waiting_ops
Date:   Tue, 27 Apr 2021 20:12:36 -0700
Message-Id: <20210428031236.3613-1-lyl2019@mail.ustc.edu.cn>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

In purge_waiting_ops, op is freed in set_op_state_purged()
when op->upcal.type is a cancel type via op_release().But
later the freed op is dereferenced in gossip_debug() via
get_opname_string(op) and op->op_state.

My patch adds variables 'opname' and 'op_state' to avoid
the uaf. But i see that op->op_state could be changed in
a lock environment and i think move all the check condition
outside set_op_state_purged() could be redundant.

Could you give some advice on how to handle the op->op_state?

Fixes: 9d9e7ba9ee8f3 ("Orangefs: improve gossip statements")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
---
 fs/orangefs/waitqueue.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/orangefs/waitqueue.c b/fs/orangefs/waitqueue.c
index beafc33d57be..e00c74051936 100644
--- a/fs/orangefs/waitqueue.c
+++ b/fs/orangefs/waitqueue.c
@@ -34,6 +34,8 @@ static void orangefs_clean_up_interrupted_operation(struct orangefs_kernel_op_s
 void purge_waiting_ops(void)
 {
 	struct orangefs_kernel_op_s *op, *tmp;
+	char *opname;
+	int op_state;
 
 	spin_lock(&orangefs_request_list_lock);
 	list_for_each_entry_safe(op, tmp, &orangefs_request_list, list) {
@@ -41,12 +43,14 @@ void purge_waiting_ops(void)
 			     "pvfs2-client-core: purging op tag %llu %s\n",
 			     llu(op->tag),
 			     get_opname_string(op));
+		opname = get_opname_string(op);
+		op_state = op->op_state;
 		set_op_state_purged(op);
 		gossip_debug(GOSSIP_DEV_DEBUG,
 			     "%s: op:%s: op_state:%d: process:%s:\n",
 			     __func__,
-			     get_opname_string(op),
-			     op->op_state,
+			     opname,
+			     op_state,
 			     current->comm);
 	}
 	spin_unlock(&orangefs_request_list_lock);
-- 
2.25.1