Hi Andrew, There is an updated version v2, which describe more clearly about the case: https://lore.kernel.org/ocfs2-devel/e9fc4b2f-1fcc-7c31-f346-59eccff50f9b@xxxxxxxxxxxxxxxxx/T/#u Thanks, Joseph On 5/26/23 4:55 AM, Andrew Morton wrote: > The patch titled > Subject: ocfs2: fix use-after-free when unmounting read-only filesystem > has been added to the -mm mm-hotfixes-unstable branch. Its filename is > ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch > > This patch will shortly appear at > https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch > > This patch will later appear in the mm-hotfixes-unstable branch at > git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm > > Before you just go and hit "reply", please: > a) Consider who else should be cc'ed > b) Prefer to cc a suitable mailing list as well > c) Ideally: find the original patch on the mailing list and do a > reply-to-all to that, adding suitable additional cc's > > *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** > > The -mm tree is included into linux-next via the mm-everything > branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm > and is updated there every 2-3 working days > > ------------------------------------------------------ > From: Luís Henriques <ocfs2-devel@xxxxxxxxxxxxxx> > Subject: ocfs2: fix use-after-free when unmounting read-only filesystem > Date: Mon, 22 May 2023 11:21:12 +0100 > > It's trivial to trigger a use-after-free bug in the ocfs2 quotas code > using fstest generic/452. After mounting a filesystem as read-only, > quotas are suspended and ocfs2_mem_dqinfo is freed through > ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access > to the oinfo will eventually cause a crash. > > Link: https://lkml.kernel.org/r/20230522102112.9031-1-lhenriques@xxxxxxx > Signed-off-by: Luís Henriques <lhenriques@xxxxxxx> > Reviewed-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx> > Tested-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx> > Cc: Mark Fasheh <mark@xxxxxxxxxx> > Cc: Joel Becker <jlbec@xxxxxxxxxxxx> > Cc: Junxiao Bi <junxiao.bi@xxxxxxxxxx> > Cc: Changwei Ge <gechangwei@xxxxxxx> > Cc: Gang He <ghe@xxxxxxxx> > Cc: Jun Piao <piaojun@xxxxxxxxxx> > Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> > --- > > fs/ocfs2/super.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > --- a/fs/ocfs2/super.c~ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem > +++ a/fs/ocfs2/super.c > @@ -952,8 +952,10 @@ static void ocfs2_disable_quotas(struct > for (type = 0; type < OCFS2_MAXQUOTAS; type++) { > if (!sb_has_quota_loaded(sb, type)) > continue; > - oinfo = sb_dqinfo(sb, type)->dqi_priv; > - cancel_delayed_work_sync(&oinfo->dqi_sync_work); > + if (!sb_has_quota_suspended(sb, type)) { > + oinfo = sb_dqinfo(sb, type)->dqi_priv; > + cancel_delayed_work_sync(&oinfo->dqi_sync_work); > + } > inode = igrab(sb->s_dquot.files[type]); > /* Turn off quotas. This will remove all dquot structures from > * memory and so they will be automatically synced to global > _ > > Patches currently in -mm which might be from ocfs2-devel@xxxxxxxxxxxxxx are > > ocfs2-fix-use-after-free-when-unmounting-read-only-filesystem.patch
