linux-kernel - Re: [syzbot] [ntfs3?] KASAN: slab-use-after-free Read in chrdev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240617102946.1524-1-hdanton@sina.com>
Date: Mon, 17 Jun 2024 18:29:46 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+5d34cc6474499a5ff516@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [ntfs3?] KASAN: slab-use-after-free Read in chrdev_open

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  83a7eefedc9b

diff -pur b/fs/namespace.c a/fs/namespace.c
--- b/fs/namespace.c	2024-06-17 18:24:14.364221500 +0800
+++ a/fs/namespace.c	2024-06-17 18:19:58.988799600 +0800
@@ -672,6 +672,14 @@ static bool legitimize_mnt(struct vfsmou
 	return false;
 }
 
+bool mnt_doomed(struct vfsmount *mnt)
+{
+	if (mnt->mnt_flags & MNT_DOOMED)
+		return true;
+
+	return 2 > mnt_get_count(real_mount(mnt));
+}
+
 /**
  * __lookup_mnt - find first child mount
  * @mnt:	parent mount
diff -pur b/fs/open.c a/fs/open.c
--- b/fs/open.c	2024-06-17 18:23:56.967279000 +0800
+++ a/fs/open.c	2024-06-17 18:22:11.065932700 +0800
@@ -952,6 +952,9 @@ static int do_dentry_open(struct file *f
 	if (!open)
 		open = f->f_op->open;
 	if (open) {
+		error = -ENODEV;
+		if (mnt_doomed(f->f_path.mnt))
+			goto cleanup_all;
 		error = open(inode, f);
 		if (error)
 			goto cleanup_all;
diff -pur b/include/linux/mount.h a/include/linux/mount.h
--- b/include/linux/mount.h	2024-06-17 18:25:07.750059900 +0800
+++ a/include/linux/mount.h	2024-06-17 18:17:35.669341200 +0800
@@ -93,6 +93,7 @@ extern bool mnt_may_suid(struct vfsmount
 extern struct vfsmount *clone_private_mount(const struct path *path);
 int mnt_get_write_access(struct vfsmount *mnt);
 void mnt_put_write_access(struct vfsmount *mnt);
+bool mnt_doomed(struct vfsmount *mnt);
 
 extern struct vfsmount *fc_mount(struct fs_context *fc);
 extern struct vfsmount *vfs_create_mount(struct fs_context *fc);
--