linux-kernel - Re: [PATCH 5/4] Squashfs: Ensure all readahead pages have been used

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <727eebc5-e01e-4737-88b8-9890d90abc39@linux.microsoft.com>
Date: Fri, 23 Aug 2024 14:02:49 -0700
From: Fan Wu <wufan@...ux.microsoft.com>
To: Christian Brauner <brauner@...nel.org>,
 Phillip Lougher <phillip@...ashfs.org.uk>
Cc: akpm@...ux-foundation.org, linux-kernel@...r.kernel.org,
 linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH 5/4] Squashfs: Ensure all readahead pages have been used



On 8/21/2024 1:12 AM, Christian Brauner wrote:
> On Wed, 21 Aug 2024 00:26:22 +0100, Phillip Lougher wrote:
>> In the recent work to remove page->index, a sanity check
>> that ensured all the readhead pages were covered by the
>> Squashfs data block was removed [1].
>>
>> To avoid any regression, this commit adds the sanity check
>> back in an equivalent way.  Namely the page actor will now
>> return error if any pages are unused after completion.
>>
>> [...]
> 
> Applied to the vfs.folio branch of the vfs/vfs.git tree.
> Patches in the vfs.folio branch should appear in linux-next soon.
> 
> Please report any outstanding bugs that were missed during review in a
> new review to the original patch series allowing us to drop it.
> 
> It's encouraged to provide Acked-bys and Reviewed-bys even though the
> patch has now been applied. If possible patch trailers will be updated.
> 
> Note that commit hashes shown below are subject to change due to rebase,
> trailer updates or similar. If in doubt, please check the listed branch.
> 
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
> branch: vfs.folio
> 
> [5/5] Squashfs: Ensure all readahead pages have been used
>        https://git.kernel.org/vfs/vfs/c/5d85f9c952d8
> 

When I was testing the linux-next branch I got
"BUG: KASAN: slab-use-after-free in squashfs_readahead+0x19f1/0x1e50"
It seems this is due to the access of `actor` just after freeing it.
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/fs/squashfs/page_actor.h#n41

-Fan