Patch "jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     jfs-fix-invalid-free-of-jfs_ip-ipimap-i_imap-in-diun.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ff5940620f1406ffb52dc2a7c4d580239fee7350
Author: Liu Shixin via Jfs-discussion <jfs-discussion@xxxxxxxxxxxxxxxxxxxxx>
Date:   Thu Dec 1 20:46:28 2022 +0800

    jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
    
    [ Upstream commit 6e2bda2c192d0244b5a78b787ef20aa10cb319b7 ]
    
    syzbot found an invalid-free in diUnmount:
    
    BUG: KASAN: double-free in slab_free mm/slub.c:3661 [inline]
    BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3674
    Free of addr ffff88806f410000 by task syz-executor131/3632
    
     CPU: 0 PID: 3632 Comm: syz-executor131 Not tainted 6.1.0-rc7-syzkaller-00012-gca57f02295f1 #0
     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
     Call Trace:
      <TASK>
      __dump_stack lib/dump_stack.c:88 [inline]
      dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
      print_address_description+0x74/0x340 mm/kasan/report.c:284
      print_report+0x107/0x1f0 mm/kasan/report.c:395
      kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:460
      ____kasan_slab_free+0xfb/0x120
      kasan_slab_free include/linux/kasan.h:177 [inline]
      slab_free_hook mm/slub.c:1724 [inline]
      slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1750
      slab_free mm/slub.c:3661 [inline]
      __kmem_cache_free+0x71/0x110 mm/slub.c:3674
      diUnmount+0xef/0x100 fs/jfs/jfs_imap.c:195
      jfs_umount+0x108/0x370 fs/jfs/jfs_umount.c:63
      jfs_put_super+0x86/0x190 fs/jfs/super.c:194
      generic_shutdown_super+0x130/0x310 fs/super.c:492
      kill_block_super+0x79/0xd0 fs/super.c:1428
      deactivate_locked_super+0xa7/0xf0 fs/super.c:332
      cleanup_mnt+0x494/0x520 fs/namespace.c:1186
      task_work_run+0x243/0x300 kernel/task_work.c:179
      exit_task_work include/linux/task_work.h:38 [inline]
      do_exit+0x664/0x2070 kernel/exit.c:820
      do_group_exit+0x1fd/0x2b0 kernel/exit.c:950
      __do_sys_exit_group kernel/exit.c:961 [inline]
      __se_sys_exit_group kernel/exit.c:959 [inline]
      __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:959
      do_syscall_x64 arch/x86/entry/common.c:50 [inline]
      do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
      entry_SYSCALL_64_after_hwframe+0x63/0xcd
    [...]
    
    JFS_IP(ipimap)->i_imap is not setting to NULL after free in diUnmount.
    If jfs_remount() free JFS_IP(ipimap)->i_imap but then failed at diMount().
    JFS_IP(ipimap)->i_imap will be freed once again.
    Fix this problem by setting JFS_IP(ipimap)->i_imap to NULL after free.
    
    Reported-by: syzbot+90a11e6b1e810785c6ff@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Liu Shixin <liushixin2@xxxxxxxxxx>
    Signed-off-by: Dave Kleikamp <dave.kleikamp@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 799d3837e7c2b..4899663996d81 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -193,6 +193,7 @@ int diUnmount(struct inode *ipimap, int mounterror)
 	 * free in-memory control structure
 	 */
 	kfree(imap);
+	JFS_IP(ipimap)->i_imap = NULL;
 
 	return (0);
 }



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux