[PATCH] autofs: pin the pipe while showing mount options

[Yifan Zhang]

With CONFIG_CHECKPOINT_RESTORE enabled, autofs_show_options() checks
sbi->pipe and dereferences it without wq_mutex or a file reference.  A
concurrent AUTOFS_IOC_CATATONIC can drop the final pipe reference and
clear sbi->pipe between the check and file_inode(), leaving show_options()
to read a freed pipe inode.

KASAN reports:

  BUG: KASAN: slab-use-after-free in autofs_show_options
  Read of size 8
  autofs_show_options
  statmount_string
  __do_sys_statmount

Take a file reference while holding wq_mutex and use that reference when
printing pipe_ino.

The patched kernel completed 500,000 teardown-versus-statmount cycles on
each of two boots without a KASAN report.

Fixes: c83aa55d0bb7 ("autofs: show pipe inode in mount options")
Signed-off-by: Yifan Zhang <yfzhang23@xxxxxxxxxxxxxx>
---
 fs/autofs/inode.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
index 066c16f2ea569..8d8551b07b48e 100644
--- a/fs/autofs/inode.c
+++ b/fs/autofs/inode.c
@@ -68,6 +68,9 @@ static int autofs_show_options(struct seq_file *m, struct dentry *root)
 {
 	struct autofs_sb_info *sbi = autofs_sbi(root->d_sb);
 	struct inode *root_inode = d_inode(root->d_sb->s_root);
+#ifdef CONFIG_CHECKPOINT_RESTORE
+	struct file *pipe;
+#endif
 
 	if (!sbi)
 		return 0;
@@ -95,10 +98,17 @@ static int autofs_show_options(struct seq_file *m, struct dentry *root)
 	if (sbi->flags & AUTOFS_SBI_IGNORE)
 		seq_puts(m, ",ignore");
 #ifdef CONFIG_CHECKPOINT_RESTORE
-	if (sbi->pipe)
-		seq_printf(m, ",pipe_ino=%llu", file_inode(sbi->pipe)->i_ino);
-	else
+	mutex_lock(&sbi->wq_mutex);
+	pipe = sbi->pipe;
+	if (pipe)
+		get_file(pipe);
+	mutex_unlock(&sbi->wq_mutex);
+	if (pipe) {
+		seq_printf(m, ",pipe_ino=%llu", file_inode(pipe)->i_ino);
+		fput(pipe);
+	} else {
 		seq_puts(m, ",pipe_ino=-1");
+	}
 #endif
 	return 0;
 }
-- 
2.39.5 (Apple Git-154)