linux-kernel - Re: [PATCH 5.4] gfs2: Don't deref jdesc in evict

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 28 Jun 2023 20:31:40 +0200
From:   Greg KH <greg@...ah.com>
To:     Dragos-Marian Panait <dragos.panait@...driver.com>
Cc:     stable@...r.kernel.org, Yang Lan <lanyang0908@...il.com>,
        Bob Peterson <rpeterso@...hat.com>,
        Andreas Gruenbacher <agruenba@...hat.com>,
        cluster-devel@...hat.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 5.4] gfs2: Don't deref jdesc in evict

On Wed, Jun 28, 2023 at 04:30:52PM +0300, Dragos-Marian Panait wrote:
> From: Bob Peterson <rpeterso@...hat.com>
> 
> [ Upstream commit 504a10d9e46bc37b23d0a1ae2f28973c8516e636 ]
> 
> On corrupt gfs2 file systems the evict code can try to reference the
> journal descriptor structure, jdesc, after it has been freed and set to
> NULL. The sequence of events is:
> 
> init_journal()
> ...
> fail_jindex:
>    gfs2_jindex_free(sdp); <------frees journals, sets jdesc = NULL
>       if (gfs2_holder_initialized(&ji_gh))
>          gfs2_glock_dq_uninit(&ji_gh);
> fail:
>    iput(sdp->sd_jindex); <--references jdesc in evict_linked_inode
>       evict()
>          gfs2_evict_inode()
>             evict_linked_inode()
>                ret = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks);
> <------references the now freed/zeroed sd_jdesc pointer.
> 
> The call to gfs2_trans_begin is done because the truncate_inode_pages
> call can cause gfs2 events that require a transaction, such as removing
> journaled data (jdata) blocks from the journal.
> 
> This patch fixes the problem by adding a check for sdp->sd_jdesc to
> function gfs2_evict_inode. In theory, this should only happen to corrupt
> gfs2 file systems, when gfs2 detects the problem, reports it, then tries
> to evict all the system inodes it has read in up to that point.
> 
> Reported-by: Yang Lan <lanyang0908@...il.com>
> Signed-off-by: Bob Peterson <rpeterso@...hat.com>
> Signed-off-by: Andreas Gruenbacher <agruenba@...hat.com>
> [DP: adjusted context]
> Signed-off-by: Dragos-Marian Panait <dragos.panait@...driver.com>
> ---
>  fs/gfs2/super.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

All now queued up, thanks.

greg k-h