On Sat, 15 Jun 2024 21:44:54 +0100 Matthew Wilcox wrote: > On Sat, Jun 15, 2024 at 07:59:53AM +0800, Hillf Danton wrote: > > On Fri, 14 Jun 2024 14:42:20 +0100 Matthew Wilcox wrote: > > > On Fri, Jun 14, 2024 at 09:18:56PM +0800, Hillf Danton wrote: > > > > Flush lru cache to avoid folio->mapping uaf in case of inode teardown. > > > > > > What? inodes are supposed to have all their folios removed before > > > being freed. Part of removing a folio sets the folio->mapping to NULL. > > > Where is the report? > > > > > Subject: Re: [syzbot] [nilfs?] [mm?] KASAN: slab-use-after-free Read in lru_add_fn > > https://lore.kernel.org/lkml/000000000000cae276061aa12d5e@xxxxxxxxxx/ > > Thanks. This fix is wrong. Of course syzbot says it fixes the problem, > but you're just avoiding putting the folios into the situation where we > have debug that would detect the problem. > > I suspect this would trigger: > Happy to test your idea. > +++ b/fs/inode.c > @@ -282,6 +282,7 @@ static struct inode *alloc_inode(struct super_block *sb) > void __destroy_inode(struct inode *inode) > { > BUG_ON(inode_has_buffers(inode)); > + BUG_ON(inode->i_data.nrpages); > inode_detach_wb(inode); > security_inode_free(inode); > fsnotify_inode_delete(inode); > > and what a real fix would look like would be calling clear_inode() > before calling iput() in nilfs_put_root(). But I'm not an expert Hm...given I_FREEING checked in clear_inode(), fix like this one could be tried in midle 2026. > in this layer of the VFS, so I might well be wrong. #syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 83a7eefedc9b --- x/mm/truncate.c +++ y/mm/truncate.c @@ -419,6 +419,9 @@ void truncate_inode_pages_range(struct a truncate_folio_batch_exceptionals(mapping, &fbatch, indices); folio_batch_release(&fbatch); } + + if (mapping_exiting(mapping)) + lru_add_drain_all(); } EXPORT_SYMBOL(truncate_inode_pages_range); --- x/fs/inode.c +++ y/fs/inode.c @@ -282,6 +282,7 @@ static struct inode *alloc_inode(struct void __destroy_inode(struct inode *inode) { BUG_ON(inode_has_buffers(inode)); + BUG_ON(inode->i_data.nrpages); inode_detach_wb(inode); security_inode_free(inode); fsnotify_inode_delete(inode); --
