[PATCH 2/2] vfs: Fix anon_inode triggering VFS_BUG_ON_INODE in may_open()

[Penglei Jiang]

may_open()
{
        ...
        switch (inode->i_mode & S_IFMT) {
        case S_IFLNK:
        case S_IFDIR:
        case S_IFBLK:
        case S_IFCHR:
        case S_IFIFO:
        case S_IFSOCK:
        case S_IFREG:
        default:
                VFS_BUG_ON_INODE(1, inode);
        }
        ...
}

Since some anonymous inodes do not have S_IFLNK, S_IFDIR, S_IFBLK,
S_IFCHR, S_IFIFO, S_IFSOCK, or S_IFREG flags set when created, they
end up in the default case branch.

When creating some anon_inode instances, the i_mode in the switch
statement is not properly set, which causes the open operation to
follow the default branch when opening anon_inode.

We could check whether the inode is an anon_inode before VFS_BUG_ON_INODE
and trigger the assertion only if it's not. However, a more reasonable
approach might be to set a flag during creation in alloc_anon_inode(),
such as inode->i_flags |= S_ANON, to explicitly mark anonymous inodes.

The code that triggers the BUG:

    #include <stdio.h>
    #include <unistd.h>
    #include <fcntl.h>
    #include <sys/timerfd.h>

    int main(int argc, char **argv) {
        int fd = timerfd_create(CLOCK_MONOTONIC, 0);
        if (fd != -1) {
            char path[256];
            sprintf(path, "/proc/self/fd/%d", fd);
            open(path, O_RDONLY);
        }

        return 0;
    }

Thank you!

Fixes: af153bb63a336 ("vfs: catch invalid modes in may_open()")
Reported-by: syzbot+5d8e79d323a13aa0b248@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://lore.kernel.org/all/67ed3fb3.050a0220.14623d.0009.GAE@xxxxxxxxxx";
Signed-off-by: Penglei Jiang <superman.xpt@xxxxxxxxx>
---
 fs/anon_inodes.c            | 4 ++++
 fs/namei.c                  | 5 ++++-
 include/linux/anon_inodes.h | 1 +
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/anon_inodes.c b/fs/anon_inodes.c
index 583ac81669c2..c29eca6106d2 100644
--- a/fs/anon_inodes.c
+++ b/fs/anon_inodes.c
@@ -303,6 +303,10 @@ int anon_inode_create_getfd(const char *name, const struct file_operations *fops
 	return __anon_inode_getfd(name, fops, priv, flags, context_inode, true);
 }
 
+inline bool is_default_anon_inode(const struct inode *inode)
+{
+    return anon_inode_inode == inode;
+}
 
 static int __init anon_inode_init(void)
 {
diff --git a/fs/namei.c b/fs/namei.c
index 360a86ca1f02..81cea4901a2f 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -40,6 +40,7 @@
 #include <linux/bitops.h>
 #include <linux/init_task.h>
 #include <linux/uaccess.h>
+#include <linux/anon_inodes.h>
 
 #include "internal.h"
 #include "mount.h"
@@ -3429,7 +3430,9 @@ static int may_open(struct mnt_idmap *idmap, const struct path *path,
 			return -EACCES;
 		break;
 	default:
-		VFS_BUG_ON_INODE(1, inode);
+		if (!is_default_anon_inode(inode)
+			&& !(inode->i_flags & S_PRIVATE))
+			VFS_BUG_ON_INODE(1, inode);
 	}
 
 	error = inode_permission(idmap, inode, MAY_OPEN | acc_mode);
diff --git a/include/linux/anon_inodes.h b/include/linux/anon_inodes.h
index edef565c2a1a..eca4a3913ba7 100644
--- a/include/linux/anon_inodes.h
+++ b/include/linux/anon_inodes.h
@@ -30,6 +30,7 @@ int anon_inode_create_getfd(const char *name,
 			    const struct file_operations *fops,
 			    void *priv, int flags,
 			    const struct inode *context_inode);
+bool is_default_anon_inode(const struct inode *inode);
 
 #endif /* _LINUX_ANON_INODES_H */
 
-- 
2.17.1