Vulnerability: The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads.
Vulnerability ID: CVE-2017-18249
CWE: CWE-362
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2018-03-26
File: fs/f2fs/node.c
Commit message: f2fs: fix race condition in between free nid allocator/initializer

In below concurrent case, allocated nid can be loaded into free nid cache
and be allocated again.

Thread A				Thread B
- f2fs_create
 - f2fs_new_inode
  - alloc_nid
   - __insert_nid_to_list(ALLOC_NID_LIST)
					- f2fs_balance_fs_bg
					 - build_free_nids
					  - __build_free_nids
					   - scan_nat_page
					    - add_free_nid
					     - __lookup_nat_cache
 - f2fs_add_link
  - init_inode_metadata
   - new_inode_page
    - new_node_page
     - set_node_addr
 - alloc_nid_done
  - __remove_nid_from_list(ALLOC_NID_LIST)
					     - __insert_nid_to_list(FREE_NID_LIST)

This patch makes nat cache lookup and free nid list operation being atomical
to avoid this race condition.

Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Commit author: Chao Yu

Vulnerable version (before fix):
 static void __remove_nid_from_list(struct f2fs_sb_info *sbi, static bool add_free_nid(struct f2fs_sb_info *sbi, nid_t nid, bool build) { 	struct f2fs_nm_info *nm_i = NM_I(sbi); 	struct free_nid *i; 	struct nat_entry *ne; 	int err;  	/* 0 nid should not be used */ 	if (unlikely(nid == 0)) 		return false;  	if (build) { 		/* do not add allocated nids */ 		ne = __lookup_nat_cache(nm_i, nid); 		if (ne && (!get_nat_flag(ne, IS_CHECKPOINTED) || 				nat_get_blkaddr(ne) != NULL_ADDR)) 			return false; 	}  	i = f2fs_kmem_cache_alloc(free_nid_slab, GFP_NOFS); 	i->nid = nid; 	i->state = NID_NEW;  	if (radix_tree_preload(GFP_NOFS)) { 		kmem_cache_free(free_nid_slab, i); 		return true; 	}  	spin_lock(&nm_i->nid_list_lock); 	err = __insert_nid_to_list(sbi, i, FREE_NID_LIST, true); 	spin_unlock(&nm_i->nid_list_lock); 	radix_tree_preload_end(); 	if (err) { 		kmem_cache_free(free_nid_slab, i); 		return true; 	} 	return true; }  static void remove_free_nid(struct f2fs_sb_info *sbi, nid_t nid)

Fixed version (after fix):
 static void __remove_nid_from_list(struct f2fs_sb_info *sbi, static bool add_free_nid(struct f2fs_sb_info *sbi, nid_t nid, bool build) { 	struct f2fs_nm_info *nm_i = NM_I(sbi); 	struct free_nid *i, *e; 	struct nat_entry *ne; 	int err = -EINVAL; 	bool ret = false;  	/* 0 nid should not be used */ 	if (unlikely(nid == 0)) 		return false;  	i = f2fs_kmem_cache_alloc(free_nid_slab, GFP_NOFS); 	i->nid = nid; 	i->state = NID_NEW;  	if (radix_tree_preload(GFP_NOFS)) 		goto err;  	spin_lock(&nm_i->nid_list_lock);  	if (build) { 		/* 		 *   Thread A             Thread B 		 *  - f2fs_create 		 *   - f2fs_new_inode 		 *    - alloc_nid 		 *     - __insert_nid_to_list(ALLOC_NID_LIST) 		 *                     - f2fs_balance_fs_bg 		 *                      - build_free_nids 		 *                       - __build_free_nids 		 *                        - scan_nat_page 		 *                         - add_free_nid 		 *                          - __lookup_nat_cache 		 *  - f2fs_add_link 		 *   - init_inode_metadata 		 *    - new_inode_page 		 *     - new_node_page 		 *      - set_node_addr 		 *  - alloc_nid_done 		 *   - __remove_nid_from_list(ALLOC_NID_LIST) 		 *                         - __insert_nid_to_list(FREE_NID_LIST) 		 */ 		ne = __lookup_nat_cache(nm_i, nid); 		if (ne && (!get_nat_flag(ne, IS_CHECKPOINTED) || 				nat_get_blkaddr(ne) != NULL_ADDR)) 			goto err_out;  		e = __lookup_free_nid_list(nm_i, nid); 		if (e) { 			if (e->state == NID_NEW) 				ret = true; 			goto err_out; 		} 	} 	ret = true; 	err = __insert_nid_to_list(sbi, i, FREE_NID_LIST, true); err_out: 	spin_unlock(&nm_i->nid_list_lock); 	radix_tree_preload_end(); err: 	if (err) 		kmem_cache_free(free_nid_slab, i); 	return ret; }  static void remove_free_nid(struct f2fs_sb_info *sbi, nid_t nid)

Patch:
patch: @@ -1761,40 +1761,67 @@ static void __remove_nid_from_list(struct f2fs_sb_info *sbi,
 static bool add_free_nid(struct f2fs_sb_info *sbi, nid_t nid, bool build)
 {
 	struct f2fs_nm_info *nm_i = NM_I(sbi);
-	struct free_nid *i;
+	struct free_nid *i, *e;
 	struct nat_entry *ne;
-	int err;
+	int err = -EINVAL;
+	bool ret = false;
 
 	/* 0 nid should not be used */
 	if (unlikely(nid == 0))
 		return false;
 
-	if (build) {
-		/* do not add allocated nids */
-		ne = __lookup_nat_cache(nm_i, nid);
-		if (ne && (!get_nat_flag(ne, IS_CHECKPOINTED) ||
-				nat_get_blkaddr(ne) != NULL_ADDR))
-			return false;
-	}
-
 	i = f2fs_kmem_cache_alloc(free_nid_slab, GFP_NOFS);
 	i->nid = nid;
 	i->state = NID_NEW;
 
-	if (radix_tree_preload(GFP_NOFS)) {
-		kmem_cache_free(free_nid_slab, i);
-		return true;
-	}
+	if (radix_tree_preload(GFP_NOFS))
+		goto err;
 
 	spin_lock(&nm_i->nid_list_lock);
+
+	if (build) {
+		/*
+		 *   Thread A             Thread B
+		 *  - f2fs_create
+		 *   - f2fs_new_inode
+		 *    - alloc_nid
+		 *     - __insert_nid_to_list(ALLOC_NID_LIST)
+		 *                     - f2fs_balance_fs_bg
+		 *                      - build_free_nids
+		 *                       - __build_free_nids
+		 *                        - scan_nat_page
+		 *                         - add_free_nid
+		 *                          - __lookup_nat_cache
+		 *  - f2fs_add_link
+		 *   - init_inode_metadata
+		 *    - new_inode_page
+		 *     - new_node_page
+		 *      - set_node_addr
+		 *  - alloc_nid_done
+		 *   - __remove_nid_from_list(ALLOC_NID_LIST)
+		 *                         - __insert_nid_to_list(FREE_NID_LIST)
+		 */
+		ne = __lookup_nat_cache(nm_i, nid);
+		if (ne && (!get_nat_flag(ne, IS_CHECKPOINTED) ||
+				nat_get_blkaddr(ne) != NULL_ADDR))
+			goto err_out;
+
+		e = __lookup_free_nid_list(nm_i, nid);
+		if (e) {
+			if (e->state == NID_NEW)
+				ret = true;
+			goto err_out;
+		}
+	}
+	ret = true;
 	err = __insert_nid_to_list(sbi, i, FREE_NID_LIST, true);
+err_out:
 	spin_unlock(&nm_i->nid_list_lock);
 	radix_tree_preload_end();
-	if (err) {
+err:
+	if (err)
 		kmem_cache_free(free_nid_slab, i);
-		return true;
-	}
-	return true;
+	return ret;
 }
 
 static void remove_free_nid(struct f2fs_sb_info *sbi, nid_t nid)
path: fs/f2fs/node.c