linux-kernel - Re: [PATCH] fs: Fix double prealloc_shrinker() in sget

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3a12cb86-5d2d-aa24-56fb-ec046570705d@gmail.com>
Date:   Sat, 25 Aug 2018 11:01:23 +0800
From:   Jia He <hejianet@...il.com>
To:     Kirill Tkhai <ktkhai@...tuozzo.com>, viro@...iv.linux.org.uk,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org, akpm@...ux-foundation.org, dhowells@...hat.com
Subject: Re: [PATCH] fs: Fix double prealloc_shrinker() in sget_fc()



On 7/11/2018 10:37 PM, Kirill Tkhai Wrote:
> Hi,
> 
> I'm observing "KASAN: use-after-free Read in shrink_slab" on recent
> linux-next in the code I've added:
> 
> https://syzkaller.appspot.com/bug?id=91767fc6346a4b9e0309a8cd7e2f356c434450b9
> 
> It seems to be not related to my patchset, since there is
> a problem with double preallocation of shrinker. We should
> use register_shrinker_prepared() in sget_fc(), since shrinker
> is already allocated in alloc_super().
> 
> Signed-off-by: Kirill Tkhai <ktkhai@...tuozzo.com>
> ---
>  fs/super.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/super.c b/fs/super.c
> index 13647d4fd262..47a819f1a300 100644
> --- a/fs/super.c
> +++ b/fs/super.c
> @@ -551,7 +551,7 @@ struct super_block *sget_fc(struct fs_context *fc,
>  	hlist_add_head(&s->s_instances, &s->s_type->fs_supers);
>  	spin_unlock(&sb_lock);
>  	get_filesystem(s->s_type);
> -	register_shrinker(&s->s_shrink);
> +	register_shrinker_prepared(&s->shrinker);

should be &s->shrink here  ?

-- 
Cheers,
Jia