MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-22 15:03:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
de9476bb4f
linux-yocto/fs
History
Jiufei Xue b187c97611 fs: writeback: fix use-after-free in __mark_inode_dirty() 
[ Upstream commit d02d2c98d25793902f65803ab853b592c7a96b29 ]

An use-after-free issue occurred when __mark_inode_dirty() get the
bdi_writeback that was in the progress of switching.

CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1
......
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __mark_inode_dirty+0x124/0x418
lr : __mark_inode_dirty+0x118/0x418
sp : ffffffc08c9dbbc0
........
Call trace:
 __mark_inode_dirty+0x124/0x418
 generic_update_time+0x4c/0x60
 file_modified+0xcc/0xd0
 ext4_buffered_write_iter+0x58/0x124
 ext4_file_write_iter+0x54/0x704
 vfs_write+0x1c0/0x308
 ksys_write+0x74/0x10c
 __arm64_sys_write+0x1c/0x28
 invoke_syscall+0x48/0x114
 el0_svc_common.constprop.0+0xc0/0xe0
 do_el0_svc+0x1c/0x28
 el0_svc+0x40/0xe4
 el0t_64_sync_handler+0x120/0x12c
 el0t_64_sync+0x194/0x198

Root cause is:

systemd-random-seed                         kworker
----------------------------------------------------------------------
___mark_inode_dirty                     inode_switch_wbs_work_fn

  spin_lock(&inode->i_lock);
  inode_attach_wb
  locked_inode_to_wb_and_lock_list
     get inode->i_wb
     spin_unlock(&inode->i_lock);
     spin_lock(&wb->list_lock)
  spin_lock(&inode->i_lock)
  inode_io_list_move_locked
  spin_unlock(&wb->list_lock)
  spin_unlock(&inode->i_lock)
                                    spin_lock(&old_wb->list_lock)
                                      inode_do_switch_wbs
                                        spin_lock(&inode->i_lock)
                                        inode->i_wb = new_wb
                                        spin_unlock(&inode->i_lock)
                                    spin_unlock(&old_wb->list_lock)
                                    wb_put_many(old_wb, nr_switched)
                                      cgwb_release
                                      old wb released
  wb_wakeup_delayed() accesses wb,
  then trigger the use-after-free
  issue

Fix this race condition by holding inode spinlock until
wb_wakeup_delayed() finished.

Signed-off-by: Jiufei Xue <jiufei.xue@samsung.com>
Link: https://lore.kernel.org/20250728100715.3863241-1-jiufei.xue@samsung.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-09-09 18:50:17 +02:00
..
9p 9p: add missing locking around taking dentry fid list 2024-10-17 15:11:47 +02:00
adfs
affs affs: don't write overlarge OFS data block size fields 2025-04-10 14:32:03 +02:00
afs afs: Fix the server_list to unuse a displaced server rather than putting it 2025-03-13 12:50:56 +01:00
autofs autofs: fix memory leak of waitqueues in autofs_catatonic_mode 2023-09-23 11:09:54 +02:00
befs
bfs
btrfs btrfs: populate otime when logging an inode item 2025-08-28 16:24:32 +02:00
cachefiles cachefiles: fix memory leak in cachefiles_add_cache() 2024-03-06 14:38:50 +00:00
ceph ceph: fix possible integer overflow in ceph_zero_objects() 2025-07-10 15:57:34 +02:00
cifs smb: client: fix use-after-free in crypt_message when using async crypto 2025-08-28 16:24:31 +02:00
coda coda: Avoid partial allocation of sig_inputArgs 2023-03-10 09:39:50 +01:00
configfs configfs: Do not override creating attribute file failure in populate_attrs() 2025-06-27 11:05:22 +01:00
cramfs
crypto
debugfs debugfs: fix automount d_fsdata usage 2024-01-25 14:52:27 -08:00
devpts
dlm dlm: make tcp still work in multi-link env 2025-06-04 14:37:56 +02:00
ecryptfs ecryptfs: Fix buffer size for tag 66 packet 2024-06-16 13:39:16 +02:00
efivarfs efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare 2025-09-04 14:28:46 +02:00
efs
erofs erofs: fix incorrect symlink detection in fast symlink 2025-01-09 13:28:30 +01:00
exfat exfat: fix double free in delayed_free 2025-06-27 11:05:28 +01:00
exportfs exportfs: use pr_debug for unreachable debug statements 2024-04-10 16:19:21 +02:00
ext2 ext2: Handle fiemap on empty files to prevent EINVAL 2025-08-28 16:24:17 +02:00
ext4 ext4: fix hole length calculation overflow in non-extent inodes 2025-08-28 16:24:28 +02:00
f2fs f2fs: fix to avoid out-of-boundary access in dnode page 2025-08-28 16:24:36 +02:00
fat fat: fix uninitialized variable 2024-10-22 15:40:40 +02:00
freevxfs
fscache
fuse virtiofs: add filesystem context source name check 2025-05-02 07:44:14 +02:00
gfs2 gfs2: move msleep to sleepable context 2025-06-27 11:05:23 +01:00
hfs hfs: fix not erasing deleted b-tree node issue 2025-08-28 16:24:16 +02:00
hfsplus hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() 2025-08-28 16:24:16 +02:00
hostfs
hpfs
hugetlbfs mm: update memfd seal write check to include F_SEAL_WRITE 2025-08-28 16:24:30 +02:00
iomap iomap: update ki_pos a little later in iomap_dio_complete 2023-12-08 08:48:05 +01:00
isofs isofs: Verify inode mode when loading from disk 2025-08-28 16:23:59 +02:00
jbd2 jbd2: prevent softlockup in jbd2_log_do_checkpoint() 2025-08-28 16:24:29 +02:00
jffs2 jffs2: check jffs2_prealloc_raw_node_refs() result in few other places 2025-06-27 11:05:34 +01:00
jfs jfs: upper bound check of tree index in dbAllocAG 2025-08-28 16:24:23 +02:00
kernfs fs/kernfs/dir: obey S_ISGID 2024-02-23 08:54:51 +01:00
ksmbd smb: server: Fix extension string in ksmbd_extract_shortname() 2025-08-28 16:24:31 +02:00
lockd nfsd: stop setting ->pg_stats for unused stats 2024-09-04 13:23:30 +02:00
minix
netfs
nfs NFS: Fix a race when updating an existing write 2025-09-04 14:28:44 +02:00
nfs_common
nfsd NFSD: detect mismatch of file handle and delegation stateid in OPEN op 2025-08-28 16:24:15 +02:00
nilfs2 nilfs2: reject invalid file types when reading inodes 2025-08-28 16:24:05 +02:00
nls fs/nls: make load_nls() take a const parameter 2023-09-19 12:22:27 +02:00
notify fsnotify: fix sending inotify event with unexpected filename 2024-12-14 19:51:13 +01:00
ntfs
ntfs3 fs/ntfs3: correctly create symlink for relative path 2025-08-28 16:24:17 +02:00
ocfs2 ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery 2025-06-27 11:05:14 +01:00
omfs
openpromfs openpromfs: finish conversion to the new mount API 2024-06-16 13:39:16 +02:00
orangefs fs/orangefs: use snprintf() instead of sprintf() 2025-08-28 16:24:23 +02:00
overlayfs ovl: Check for NULL d_inode() in ovl_dentry_upper() 2025-07-10 15:57:34 +02:00
proc fs/proc: do_task_stat: use __for_each_thread() 2025-07-17 18:30:47 +02:00
pstore pstore/blk: trivial typo fixes 2025-03-13 12:49:51 +01:00
qnx4
qnx6
quota quota: flush quota_release_work upon quota writeback 2024-12-14 19:51:22 +01:00
ramfs shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs 2023-07-23 13:47:33 +02:00
reiserfs reiserfs: Check the return value from __getblk() 2023-09-19 12:22:30 +02:00
romfs
smbfs_common
squashfs squashfs: fix memory leak in squashfs_fill_super 2025-08-28 16:24:34 +02:00
sysfs fs: sysfs: Fix reference leak in sysfs_break_active_protection() 2024-04-27 17:05:28 +02:00
sysv sysv: don't call sb_bread() with pointers_lock held 2024-04-13 13:01:44 +02:00
tracefs tracefs: Add missing lockdown check to tracefs_create_dir() 2023-09-23 11:10:02 +02:00
ubifs ubifs: skip dumping tnc tree when zroot is null 2025-03-13 12:50:11 +01:00
udf udf: Fix directory iteration for longer tail extents 2025-09-04 14:28:44 +02:00
ufs
unicode Revert "unicode: Don't special case ignorable code points" 2024-12-14 19:51:44 +01:00
vboxsf vboxsf: fix building with GCC 15 2025-04-10 14:31:50 +02:00
verity fsverity: skip PKCS#7 parser when keyring is empty 2023-09-19 12:22:52 +02:00
xfs xfs: do not propagate ENODATA disk errors into xattr code 2025-09-04 14:28:48 +02:00
zonefs zonefs: Improve error handling 2024-03-01 13:21:43 +01:00
aio.c fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion 2024-04-10 16:18:46 +02:00
anon_inodes.c
attr.c attr: block mode changes of symlinks 2023-09-23 11:10:01 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c fs: binfmt_elf_efpic: don't use missing interpreter's properties 2024-09-04 13:23:24 +02:00
binfmt_elf.c
binfmt_flat.c binfmt_flat: Fix integer overflow bug on 32 bit systems 2025-03-13 12:50:24 +01:00
binfmt_misc.c binfmt_misc: cleanup on filesystem umount 2024-09-04 13:23:22 +02:00
binfmt_script.c
buffer.c fs/buffer: fix use-after-free when call bh_read() helper 2025-08-28 16:24:34 +02:00
char_dev.c
compat_binfmt_elf.c
coredump.c coredump: hand a pidfd to the usermode coredump helper 2025-06-04 14:38:07 +02:00
d_path.c
dax.c
dcache.c fs: better handle deep ancestor chains in is_subdir() 2024-07-27 10:46:13 +02:00
direct-io.c
drop_caches.c
eventfd.c eventfd: prevent underflow for eventfd semaphores 2023-09-19 12:22:30 +02:00
eventpoll.c eventpoll: Fix semi-unbounded recursion 2025-08-28 16:24:15 +02:00
exec.c exec: don't WARN for racy path_noexec check 2024-11-01 01:52:35 +01:00
fcntl.c fs: Fix file_set_fowner LSM hook inconsistencies 2024-10-17 15:11:15 +02:00
fhandle.c do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak 2024-03-26 18:21:14 -04:00
file_table.c fs: fix proc_handler for sysctl_nr_open 2025-03-13 12:49:50 +01:00
file.c alloc_fdtable(): change calling conventions. 2025-08-28 16:24:39 +02:00
filesystems.c fs/filesystems: Fix potential unsigned integer underflow in fs_name() 2025-06-27 11:05:20 +01:00
fs_context.c fs: avoid empty option when generating legacy mount string 2023-07-23 13:47:34 +02:00
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c fs: writeback: fix use-after-free in __mark_inode_dirty() 2025-09-09 18:50:17 +02:00
fsopen.c
init.c
inode.c fs: move inode sysctls to its own file 2025-03-13 12:49:50 +01:00
internal.h nfs: use vfs setgid helper 2023-08-30 16:18:19 +02:00
ioctl.c lsm: new security_file_ioctl_compat() hook 2024-02-23 08:54:25 +01:00
Kconfig nfs: add missing selections of CONFIG_CRC32 2025-05-02 07:44:12 +02:00
Kconfig.binfmt
kernel_read_file.c
libfs.c better lockdep annotations for simple_recursive_removal() 2025-08-28 16:24:16 +02:00
locks.c filelock: Fix fcntl/close race recovery compat path 2024-07-27 10:46:17 +02:00
Makefile
mbcache.c mbcache: Avoid nesting of cache->c_list_lock under bit locks 2023-01-12 11:59:20 +01:00
mount.h
mpage.c
namei.c fuse: don't truncate cached, mutated symlink 2025-04-10 14:31:51 +02:00
namespace.c use uniform permission checks for all mount propagation changes 2025-08-28 16:24:34 +02:00
no-block.c
nsfs.c
open.c openat2: explicitly return -E2BIG for (usize > PAGE_SIZE) 2024-11-01 01:52:37 +01:00
pipe.c fs/pipe: Fix lockdep false-positive in watchqueue pipe_write() 2024-04-10 16:19:42 +02:00
pnode.c pnode: terminate at peers of source 2023-01-12 11:58:47 +01:00
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c
remap_range.c
select.c select: Fix unbalanced user_access_end() 2025-03-13 12:49:51 +01:00
seq_file.c
signalfd.c
splice.c
stack.c
stat.c
statfs.c statfs: enforce statfs[64] structure initialization 2023-05-24 17:36:54 +01:00
super.c fs: explicitly unregister per-superblock BDIs 2024-10-17 15:10:43 +02:00
sync.c
timerfd.c
userfaultfd.c Fix userfaultfd_api to return EINVAL as expected 2024-07-18 13:07:42 +02:00
utimes.c
xattr.c