linux-kernel - Re: [syzbot] [mm?] kernel BUG in const_folio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241128130340.2021-1-hdanton@sina.com>
Date: Thu, 28 Nov 2024 21:03:40 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+9f9a7f73fb079b2387a6@...kaller.appspotmail.com>
Cc: David Hildenbrand <david@...hat.com>,
	linux-kernel@...r.kernel.org,
	linux-mm@...ck.org,
	syzkaller-bugs@...glegroups.com,
	Matthew Wilcox <willy@...radead.org>
Subject: Re: [syzbot] [mm?] kernel BUG in const_folio_flags (2)

On Thu, 28 Nov 2024 13:23:15 +0100 David Hildenbrand <david@...hat.com>
> 
> Ah, now I get it; at the point int time we check it actually isn't in 
> the pagecache anymore. We perform a folio_test_locked() check before the 
> folio_try_get(), which is wrong as the folio can get freed+reallocated 
> in the meantime.
> 
> The easy fix would be:

#syz test

--- x/mm/filemap.c
+++ y/mm/filemap.c
@@ -3502,10 +3502,10 @@ static struct folio *next_uptodate_folio
 			continue;
 		if (xa_is_value(folio))
 			continue;
-		if (folio_test_locked(folio))
-			continue;
 		if (!folio_try_get(folio))
 			continue;
+		if (folio_test_locked(folio))
+			goto skip;
 		/* Has the page moved or been split? */
 		if (unlikely(folio != xas_reload(xas)))
 			goto skip;
--