linux-kernel - Re: [PATCH] filelock: fix potential use-after-free in posix_lock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZoVX87bMLcCVXPOS@tissot.1015granger.net>
Date: Wed, 3 Jul 2024 09:53:55 -0400
From: Chuck Lever <chuck.lever@...cle.com>
To: Jeff Layton <jlayton@...nel.org>
Cc: Alexander Aring <alex.aring@...il.com>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>,
        Matthias Brugger <matthias.bgg@...il.com>,
        AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org,
        linux-mediatek@...ts.infradead.org,
        Light Hsieh (謝明燈) <Light.Hsieh@...iatek.com>
Subject: Re: [PATCH] filelock: fix potential use-after-free in
 posix_lock_inode

On Tue, Jul 02, 2024 at 06:44:48PM -0400, Jeff Layton wrote:
> Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode().
> The request pointer had been changed earlier to point to a lock entry
> that was added to the inode's list. However, before the tracepoint could
> fire, another task raced in and freed that lock.
> 
> Fix this by moving the tracepoint inside the spinlock, which should
> ensure that this doesn't happen.
> 
> Fixes: 74f6f5912693 ("locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock")
> Link: https://lore.kernel.org/linux-fsdevel/724ffb0a2962e912ea62bb0515deadf39c325112.camel@kernel.org/
> Reported-by: Light Hsieh (謝明燈) <Light.Hsieh@...iatek.com>
> Signed-off-by: Jeff Layton <jlayton@...nel.org>
> ---
>  fs/locks.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/locks.c b/fs/locks.c
> index c360d1992d21..bdd94c32256f 100644
> --- a/fs/locks.c
> +++ b/fs/locks.c
> @@ -1367,9 +1367,9 @@ static int posix_lock_inode(struct inode *inode, struct file_lock *request,
>  		locks_wake_up_blocks(&left->c);
>  	}
>   out:
> +	trace_posix_lock_inode(inode, request, error);
>  	spin_unlock(&ctx->flc_lock);
>  	percpu_up_read(&file_rwsem);
> -	trace_posix_lock_inode(inode, request, error);
>  	/*
>  	 * Free any unused locks.
>  	 */
> 
> ---
> base-commit: e9d22f7a6655941fc8b2b942ed354ec780936b3e
> change-id: 20240702-filelock-6-10-3fa00ca4fe53
> 
> Best regards,
> -- 
> Jeff Layton <jlayton@...nel.org>
> 

Reviewed-by: Chuck Lever <chuck.lever@...cle.com>

-- 
Chuck Lever