Patch "fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected" has been added to the 6.2-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected

to the 6.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     fs-use-check_data_corruption-when-kernel-bugs-are-de.patch
and it can be found in the queue-6.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9a130f704610edcbc6a140df733a27c01ad92719
Author: Jann Horn <jannh@xxxxxxxxxx>
Date:   Mon Jan 16 20:14:25 2023 +0100

    fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
    
    [ Upstream commit 47d586913f2abec4d240bae33417f537fda987ec ]
    
    Currently, filp_close() and generic_shutdown_super() use printk() to log
    messages when bugs are detected. This is problematic because infrastructure
    like syzkaller has no idea that this message indicates a bug.
    In addition, some people explicitly want their kernels to BUG() when kernel
    data corruption has been detected (CONFIG_BUG_ON_DATA_CORRUPTION).
    And finally, when generic_shutdown_super() detects remaining inodes on a
    system without CONFIG_BUG_ON_DATA_CORRUPTION, it would be nice if later
    accesses to a busy inode would at least crash somewhat cleanly rather than
    walking through freed memory.
    
    To address all three, use CHECK_DATA_CORRUPTION() when kernel bugs are
    detected.
    
    Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
    Reviewed-by: Christian Brauner (Microsoft) <brauner@xxxxxxxxxx>
    Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Signed-off-by: Christian Brauner (Microsoft) <brauner@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/open.c b/fs/open.c
index 82c1a28b33089..ceb88ac0ca3b2 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -1411,8 +1411,9 @@ int filp_close(struct file *filp, fl_owner_t id)
 {
 	int retval = 0;
 
-	if (!file_count(filp)) {
-		printk(KERN_ERR "VFS: Close: file count is 0\n");
+	if (CHECK_DATA_CORRUPTION(file_count(filp) == 0,
+			"VFS: Close: file count is 0 (f_op=%ps)",
+			filp->f_op)) {
 		return 0;
 	}
 
diff --git a/fs/super.c b/fs/super.c
index 12c08cb20405d..cf737ec2bd05c 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -491,10 +491,23 @@ void generic_shutdown_super(struct super_block *sb)
 		if (sop->put_super)
 			sop->put_super(sb);
 
-		if (!list_empty(&sb->s_inodes)) {
-			printk("VFS: Busy inodes after unmount of %s. "
-			   "Self-destruct in 5 seconds.  Have a nice day...\n",
-			   sb->s_id);
+		if (CHECK_DATA_CORRUPTION(!list_empty(&sb->s_inodes),
+				"VFS: Busy inodes after unmount of %s (%s)",
+				sb->s_id, sb->s_type->name)) {
+			/*
+			 * Adding a proper bailout path here would be hard, but
+			 * we can at least make it more likely that a later
+			 * iput_final() or such crashes cleanly.
+			 */
+			struct inode *inode;
+
+			spin_lock(&sb->s_inode_list_lock);
+			list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
+				inode->i_op = VFS_PTR_POISON;
+				inode->i_sb = VFS_PTR_POISON;
+				inode->i_mapping = VFS_PTR_POISON;
+			}
+			spin_unlock(&sb->s_inode_list_lock);
 		}
 	}
 	spin_lock(&sb_lock);
diff --git a/include/linux/poison.h b/include/linux/poison.h
index 2d3249eb0e62d..0e8a1f2ceb2f1 100644
--- a/include/linux/poison.h
+++ b/include/linux/poison.h
@@ -84,4 +84,7 @@
 /********** kernel/bpf/ **********/
 #define BPF_PTR_POISON ((void *)(0xeB9FUL + POISON_POINTER_DELTA))
 
+/********** VFS **********/
+#define VFS_PTR_POISON ((void *)(0xF5 + POISON_POINTER_DELTA))
+
 #endif