linux-kernel - [PATCH mm-nonmm-unstable v2 1/2] squashfs: fix page update race

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230526-squashfs-cache-fixup-v2-1-6fb7723c3647@axis.com>
Date:   Fri, 26 May 2023 15:57:30 +0200
From:   Vincent Whitchurch <vincent.whitchurch@...s.com>
To:     Phillip Lougher <phillip@...ashfs.org.uk>,
        Andrew Morton <akpm@...ux-foundation.org>
CC:     <hch@....de>, <linux-kernel@...r.kernel.org>, <kernel@...s.com>,
        "Vincent Whitchurch" <vincent.whitchurch@...s.com>
Subject: [PATCH mm-nonmm-unstable v2 1/2] squashfs: fix page update race

We only put the page into the cache after we've read it, so the
PageUptodate() check should not be necessary.  In fact, it's actively
harmful since the check could fail (since we used find_get_page() and
not find_lock_page()) and we could end up submitting a page for I/O
after it has been read and while it's actively being used, which could
lead to corruption depending on what the block driver does with it.

Reviewed-by: Christoph Hellwig <hch@....de>
Signed-off-by: Vincent Whitchurch <vincent.whitchurch@...s.com>
---
 fs/squashfs/block.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 6285f5afb6c6..f2412e5fc84b 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -92,7 +92,7 @@ static int squashfs_bio_read_cached(struct bio *fullbio,
 	bio_for_each_segment_all(bv, fullbio, iter_all) {
 		struct page *page = bv->bv_page;
 
-		if (page->mapping == cache_mapping && PageUptodate(page)) {
+		if (page->mapping == cache_mapping) {
 			idx++;
 			continue;
 		}

-- 
2.34.1