linux-kernel - Re: [PATCH next] gfs2: Add sanity check for sd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHc6FU5Ay5HostiVPxyE_DuE-djScdV32B3iDrzsnX6e7-UWgQ@mail.gmail.com>
Date: Thu, 16 Oct 2025 18:43:05 +0200
From: Andreas Gruenbacher <agruenba@...hat.com>
To: Edward Adam Davis <eadavis@...com>
Cc: syzbot+6b156e132970e550194c@...kaller.appspotmail.com, 
	gfs2@...ts.linux.dev, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [PATCH next] gfs2: Add sanity check for sd_jdesc

Hello,

On Wed, Oct 15, 2025 at 12:00 PM Edward Adam Davis <eadavis@...com> wrote:
> Asynchronous withdraw, when sd_withdraw_work is scheduled later than
> put_super, will set sd_jdesc to NULL when clearing all journal index
> information, triggering the syz report uaf.

that's not quite what's happening here; we are actually looking at a
failure in gfs2_fill_super() which calls init_inodes(UNDO) ->
init_journal(UNDO) -> gfs2_jindex_free() before flushing the
asynchronous withdraw work. A similar ordering issue exists in
gfs2_put_super() as well, though. I'll fix that in "gfs2: Asynchronous
withdraw" by moving the flush_work() calls into the proper place.

Thanks,
Andreas