linux-kernel - [PATCH] fs: do not push freeing inode to b_dirty

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221113152439.2821942-1-feldsherov@google.com>
Date:   Sun, 13 Nov 2022 17:24:39 +0200
From:   Svyatoslav Feldsherov <feldsherov@...gle.com>
To:     Alexander Viro <viro@...iv.linux.org.uk>,
        Lukas Czerner <lczerner@...hat.com>,
        "Theodore Ts'o" <tytso@....edu>, Jan Kara <jack@...e.cz>
Cc:     syzbot+6ba92bd00d5093f7e371@...kaller.appspotmail.com,
        oferz@...gle.com, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Svyatoslav Feldsherov <feldsherov@...gle.com>
Subject: [PATCH] fs: do not push freeing inode to b_dirty_time list

After commit cbfecb927f42 ("fs: record I_DIRTY_TIME even if inode
already has I_DIRTY_INODE") writeiback_single_inode can push inode with
I_DIRTY_TIME set to b_dirty_time list. In case of freeing inode with
I_DIRTY_TIME set this can happened after deletion of inode io_list at
evict. Stack trace is following.

evict
fat_evict_inode
fat_truncate_blocks
fat_flush_inodes
writeback_inode
sync_inode_metadata
writeback_single_inode

This will lead to use after free in flusher thread.

Fixes: cbfecb927f42 ("fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE")
Reported-by: syzbot+6ba92bd00d5093f7e371@...kaller.appspotmail.com
Signed-off-by: Svyatoslav Feldsherov <feldsherov@...gle.com>
---
 fs/fs-writeback.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 443f83382b9b..31c93cbdb3fe 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -1718,7 +1718,7 @@ static int writeback_single_inode(struct inode *inode,
 	 */
 	if (!(inode->i_state & I_DIRTY_ALL))
 		inode_cgwb_move_to_attached(inode, wb);
-	else if (!(inode->i_state & I_SYNC_QUEUED)) {
+	else if (!(inode->i_state & (I_SYNC_QUEUED | I_FREEING))) {
 		if ((inode->i_state & I_DIRTY))
 			redirty_tail_locked(inode, wb);
 		else if (inode->i_state & I_DIRTY_TIME) {
-- 
2.38.1.431.g37b22c650d-goog