linux-kernel - Re: [PATCH 5.10/5.15 v2 0/1 RESEND] mm/truncate: fix WARNING in ext4_set_page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f406f7b3901e4471ab1ecd432aba695b@omp.ru>
Date: Mon, 26 Feb 2024 06:45:12 +0000
From: Roman Smirnov <r.smirnov@....ru>
To: "stable@...r.kernel.org" <stable@...r.kernel.org>, Greg Kroah-Hartman
	<gregkh@...uxfoundation.org>
CC: "Matthew Wilcox (Oracle)" <willy@...radead.org>, Andrew Morton
	<akpm@...ux-foundation.org>, Alexey Khoroshilov <khoroshilov@...ras.ru>,
	Sergey Shtylyov <s.shtylyov@....ru>, Karina Yankevich <k.yankevich@....ru>,
	"lvc-project@...uxtesting.org" <lvc-project@...uxtesting.org>,
	"linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>
Subject: Re: [PATCH 5.10/5.15 v2 0/1 RESEND] mm/truncate: fix WARNING in
 ext4_set_page_dirty()

On Tue, 13 Feb, 2024 14:09:33 +0000, Roman Smirnov wrote:
> Syzkaller reports warning in ext4_set_page_dirty() in 5.10 and 5.15
> stable releases. It happens because invalidate_inode_page() frees pages
> that are needed for the system. To fix this we need to add additional
> checks to the function. page_mapped() checks if a page exists in the
> page tables, but this is not enough. The page can be used in other places:
> https://elixir.bootlin.com/linux/v6.8-rc1/source/include/linux/page_ref.h#L71
>
> Kernel outputs an error line related to direct I/O:
> https://syzkaller.appspot.com/text?tag=CrashLog&x=14ab52dac80000
>
> The problem can be fixed in 5.10 and 5.15 stable releases by the
> following patch.
>
> The patch replaces page_mapped() call with check that finds additional
> references to the page excluding page cache and filesystem private data.
> If additional references exist, the page cannot be freed.
>
> This version does not include the first patch from the first version.
> The problem can be fixed without it.
>
> Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
>
> Link: https://syzkaller.appspot.com/bug?extid=02f21431b65c214aa1d6
>
> Previous discussion:
> https://lore.kernel.org/all/20240125130947.600632-1-r.smirnov@omp.ru/T/
>
> Matthew Wilcox (Oracle) (1):
>   mm/truncate: Replace page_mapped() call in invalidate_inode_page()
>
>  mm/truncate.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Hello. 

Sorry to bother you, do you have any comments on the patch?