Merge: kernfs: fix use-after-free in __kernfs_remove

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/2020

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2143947

Upstream status: Linus

Syzkaller triggered concurrent calls to kernfs_remove_by_name_ns()
for the same file resulting in a KASAN detected use-after-free. The
race occurs when the root node is freed during kernfs_drain().

The change prevents this by acquiring an additional reference for
the root of the sub-tree of kernfs nodes that is being removed
before calling __kernfs_remove().

Signed-off-by: Ian Kent <ikent@redhat.com>

Approved-by: Bill O'Donnell <bodonnel@redhat.com>
Approved-by: Miklos Szeredi <mszeredi@redhat.com>

Signed-off-by: Herton R. Krzesinski <herton@redhat.com>

Author: Herton R. Krzesinski

fs/kernfs/dir.c

@@ -1569,8 +1569,11 @@ int kernfs_remove_by_name_ns(struct kernfs_node *parent, const char *name,
 	down_write(&root->kernfs_rwsem);
 
 	kn = kernfs_find_ns(parent, name, ns);
-	if (kn)
+	if (kn) {
+		kernfs_get(kn);
 		__kernfs_remove(kn);
+		kernfs_put(kn);
+	}
 
 	up_write(&root->kernfs_rwsem);