linux-kernel - Re: kernel bug found and suggestions for fixing it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <hom2of3ookiuoizx6r6ye3fixnhimcl7kxpqk6kebhyzul2hmk@3h3nkrvpfddo>
Date: Thu, 6 Mar 2025 00:29:37 +0900
From: Sergey Senozhatsky <senozhatsky@...omium.org>
To: ffhgfv <744439878@...com>
Cc: minchan <minchan@...nel.org>, senozhatsky <senozhatsky@...omium.org>, 
	akpm <akpm@...ux-foundation.org>, linux-mm <linux-mm@...ck.org>, 
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: kernel bug found and suggestions for fixing it

On (25/03/05 09:49), ffhgfv wrote:
> Hello, I found a bug titled "  BUG: corrupted list in fix_fullness_group "
> with modified syzkaller in the lasted upstream related to  ZSMALLOC.
[..]
> static int fix_fullness_group(struct size_class *class, struct zspage *zspage)
> {
> 	int newfg;
> 
> 	newfg = get_fullness_group(class, zspage);
> 	if (newfg == zspage-&gt;fullness)
> 		goto out;
> ++  spin_lock(&amp;class-&gt;lock);
> 	remove_zspage(class, zspage);
> 	insert_zspage(class, zspage, newfg);
> ++  spin_unlock(&amp;class-&gt;lock);
> out:
> 	return newfg;
> }

fix_fullness_group() is *always* called under class->lock.
zs_malloc() calls it under class->lock, so does  zs_free().