This is a note to let you know that I've just added the patch titled
xfs: use kmem_cache_free() for kmem_cache objects
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
xfs-use-kmem_cache_free-for-kmem_cache-objects.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Thu Jun 30 01:21:44 PM CEST 2022
From: Leah Rumancik <leah.rumancik@xxxxxxxxx>
Date: Tue, 28 Jun 2022 11:39:45 -0700
Subject: xfs: use kmem_cache_free() for kmem_cache objects
To: stable@xxxxxxxxxxxxxxx
Cc: linux-xfs@xxxxxxxxxxxxxxx, amir73il@xxxxxxxxx, Rustam Kovhaev <rkovhaev@xxxxxxxxx>, "Darrick J . Wong" <djwong@xxxxxxxxxx>, Leah Rumancik <leah.rumancik@xxxxxxxxx>
Message-ID: <20220628183951.3425528-2-leah.rumancik@xxxxxxxxx>
From: Rustam Kovhaev <rkovhaev@xxxxxxxxx>
[ Upstream commit c30a0cbd07ecc0eec7b3cd568f7b1c7bb7913f93 ]
For kmalloc() allocations SLOB prepends the blocks with a 4-byte header,
and it puts the size of the allocated blocks in that header.
Blocks allocated with kmem_cache_alloc() allocations do not have that
header.
SLOB explodes when you allocate memory with kmem_cache_alloc() and then
try to free it with kfree() instead of kmem_cache_free().
SLOB will assume that there is a header when there is none, read some
garbage to size variable and corrupt the adjacent objects, which
eventually leads to hang or panic.
Let's make XFS work with SLOB by using proper free function.
Fixes: 9749fee83f38 ("xfs: enable the xfs_defer mechanism to process extents to free")
Signed-off-by: Rustam Kovhaev <rkovhaev@xxxxxxxxx>
Reviewed-by: Darrick J. Wong <djwong@xxxxxxxxxx>
Signed-off-by: Darrick J. Wong <djwong@xxxxxxxxxx>
Signed-off-by: Leah Rumancik <leah.rumancik@xxxxxxxxx>
Acked-by: Darrick J. Wong <djwong@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/xfs/xfs_extfree_item.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -482,7 +482,7 @@ xfs_extent_free_finish_item(
free->xefi_startblock,
free->xefi_blockcount,
&free->xefi_oinfo, free->xefi_skip_discard);
- kmem_free(free);
+ kmem_cache_free(xfs_bmap_free_item_zone, free);
return error;
}
@@ -502,7 +502,7 @@ xfs_extent_free_cancel_item(
struct xfs_extent_free_item *free;
free = container_of(item, struct xfs_extent_free_item, xefi_list);
- kmem_free(free);
+ kmem_cache_free(xfs_bmap_free_item_zone, free);
}
const struct xfs_defer_op_type xfs_extent_free_defer_type = {
@@ -564,7 +564,7 @@ xfs_agfl_free_finish_item(
extp->ext_len = free->xefi_blockcount;
efdp->efd_next_extent++;
- kmem_free(free);
+ kmem_cache_free(xfs_bmap_free_item_zone, free);
return error;
}
Patches currently in stable-queue which might be from leah.rumancik@xxxxxxxxx are
queue-5.15/xfs-only-bother-with-sync_filesystem-during-readonly-remount.patch
queue-5.15/xfs-prevent-uaf-in-xfs_log_item_in_current_chkpt.patch
queue-5.15/xfs-fix-the-free-logic-of-state-in-xfs_attr_node_hasname.patch
queue-5.15/xfs-punch-out-data-fork-delalloc-blocks-on-cow-writeback-failure.patch
queue-5.15/xfs-use-kmem_cache_free-for-kmem_cache-objects.patch
queue-5.15/xfs-remove-all-cow-fork-extents-when-remounting-readonly.patch
queue-5.15/xfs-check-sb_meta_uuid-for-dabuf-buffer-recovery.patch
