diff mbox series

[1/1] fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()

Message ID 20230701140542.2252-2-andrew.kanner@gmail.com
State New
Headers
Series fs/jfs: fix KASAN double-free warnings after failed jfs_remount() |

Commit Message

Andrew Kanner July 1, 2023, 2:05 p.m. UTC 
  Syzkaller reported the following issue:
==================================================================
BUG: KASAN: double-free in slab_free mm/slub.c:3787 [inline]
BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3800
Free of addr ffff888086408000 by task syz-executor.4/12750
[...]
Call Trace:
 <TASK>
[...]
 kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:482
 ____kasan_slab_free+0xfb/0x120
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1781 [inline]
 slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807
 slab_free mm/slub.c:3787 [inline]
 __kmem_cache_free+0x71/0x110 mm/slub.c:3800
 dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264
 jfs_umount+0x248/0x3b0 fs/jfs/jfs_umount.c:87
 jfs_put_super+0x86/0x190 fs/jfs/super.c:194
 generic_shutdown_super+0x130/0x310 fs/super.c:492
 kill_block_super+0x79/0xd0 fs/super.c:1386
 deactivate_locked_super+0xa7/0xf0 fs/super.c:332
 cleanup_mnt+0x494/0x520 fs/namespace.c:1291
 task_work_run+0x243/0x300 kernel/task_work.c:179
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0x124/0x150 kernel/entry/common.c:171
 exit_to_user_mode_prepare+0xb2/0x140 kernel/entry/common.c:203
 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
 syscall_exit_to_user_mode+0x26/0x60 kernel/entry/common.c:296
 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
[...]
 </TASK>

Allocated by task 13352:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
 ____kasan_kmalloc mm/kasan/common.c:371 [inline]
 __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380
 kmalloc include/linux/slab.h:580 [inline]
 dbMount+0x54/0x980 fs/jfs/jfs_dmap.c:164
 jfs_mount+0x1dd/0x830 fs/jfs/jfs_mount.c:121
 jfs_fill_super+0x590/0xc50 fs/jfs/super.c:556
 mount_bdev+0x26c/0x3a0 fs/super.c:1359
 legacy_get_tree+0xea/0x180 fs/fs_context.c:610
 vfs_get_tree+0x88/0x270 fs/super.c:1489
 do_new_mount+0x289/0xad0 fs/namespace.c:3145
 do_mount fs/namespace.c:3488 [inline]
 __do_sys_mount fs/namespace.c:3697 [inline]
 __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 13352:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:518
 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1781 [inline]
 slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807
 slab_free mm/slub.c:3787 [inline]
 __kmem_cache_free+0x71/0x110 mm/slub.c:3800
 dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264
 jfs_mount_rw+0x545/0x740 fs/jfs/jfs_mount.c:247
 jfs_remount+0x3db/0x710 fs/jfs/super.c:454
 reconfigure_super+0x3bc/0x7b0 fs/super.c:935
 vfs_fsconfig_locked fs/fsopen.c:254 [inline]
 __do_sys_fsconfig fs/fsopen.c:439 [inline]
 __se_sys_fsconfig+0xad5/0x1060 fs/fsopen.c:314
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
[...]

JFS_SBI(ipbmap->i_sb)->bmap wasn't set to NULL after kfree() in
dbUnmount().

Syzkaller uses faultinject to reproduce this KASAN double-free
warning. The issue is triggered if either diMount() or dbMount() fail
in jfs_remount(), since diUnmount() or dbUnmount() already happened in
such a case - they will do double-free on next execution: jfs_umount
or jfs_remount.

Tested on both upstream and jfs-next by syzkaller.

Reported-and-tested-by: syzbot+6a93efb725385bc4b2e9@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000471f2d05f1ce8bad@google.com/T/
Link: https://syzkaller.appspot.com/bug?extid=6a93efb725385bc4b2e9
Signed-off-by: Andrew Kanner <andrew.kanner@gmail.com>
---
 fs/jfs/jfs_dmap.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Andrew Kanner July 18, 2023, 3:39 p.m. UTC | #1 
On Sat, Jul 01, 2023 at 05:05:42PM +0300, Andrew Kanner wrote:
> Syzkaller reported the following issue:
> ==================================================================
> BUG: KASAN: double-free in slab_free mm/slub.c:3787 [inline]
> BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3800
> Free of addr ffff888086408000 by task syz-executor.4/12750
> [...]
> Call Trace:
>  <TASK>
> [...]
>  kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:482
>  ____kasan_slab_free+0xfb/0x120
>  kasan_slab_free include/linux/kasan.h:177 [inline]
>  slab_free_hook mm/slub.c:1781 [inline]
>  slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807
>  slab_free mm/slub.c:3787 [inline]
>  __kmem_cache_free+0x71/0x110 mm/slub.c:3800
>  dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264
>  jfs_umount+0x248/0x3b0 fs/jfs/jfs_umount.c:87
>  jfs_put_super+0x86/0x190 fs/jfs/super.c:194
>  generic_shutdown_super+0x130/0x310 fs/super.c:492
>  kill_block_super+0x79/0xd0 fs/super.c:1386
>  deactivate_locked_super+0xa7/0xf0 fs/super.c:332
>  cleanup_mnt+0x494/0x520 fs/namespace.c:1291
>  task_work_run+0x243/0x300 kernel/task_work.c:179
>  resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
>  exit_to_user_mode_loop+0x124/0x150 kernel/entry/common.c:171
>  exit_to_user_mode_prepare+0xb2/0x140 kernel/entry/common.c:203
>  __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
>  syscall_exit_to_user_mode+0x26/0x60 kernel/entry/common.c:296
>  do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> [...]
>  </TASK>
> 
> Allocated by task 13352:
>  kasan_save_stack mm/kasan/common.c:45 [inline]
>  kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
>  ____kasan_kmalloc mm/kasan/common.c:371 [inline]
>  __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380
>  kmalloc include/linux/slab.h:580 [inline]
>  dbMount+0x54/0x980 fs/jfs/jfs_dmap.c:164
>  jfs_mount+0x1dd/0x830 fs/jfs/jfs_mount.c:121
>  jfs_fill_super+0x590/0xc50 fs/jfs/super.c:556
>  mount_bdev+0x26c/0x3a0 fs/super.c:1359
>  legacy_get_tree+0xea/0x180 fs/fs_context.c:610
>  vfs_get_tree+0x88/0x270 fs/super.c:1489
>  do_new_mount+0x289/0xad0 fs/namespace.c:3145
>  do_mount fs/namespace.c:3488 [inline]
>  __do_sys_mount fs/namespace.c:3697 [inline]
>  __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674
>  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> Freed by task 13352:
>  kasan_save_stack mm/kasan/common.c:45 [inline]
>  kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
>  kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:518
>  ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
>  kasan_slab_free include/linux/kasan.h:177 [inline]
>  slab_free_hook mm/slub.c:1781 [inline]
>  slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807
>  slab_free mm/slub.c:3787 [inline]
>  __kmem_cache_free+0x71/0x110 mm/slub.c:3800
>  dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264
>  jfs_mount_rw+0x545/0x740 fs/jfs/jfs_mount.c:247
>  jfs_remount+0x3db/0x710 fs/jfs/super.c:454
>  reconfigure_super+0x3bc/0x7b0 fs/super.c:935
>  vfs_fsconfig_locked fs/fsopen.c:254 [inline]
>  __do_sys_fsconfig fs/fsopen.c:439 [inline]
>  __se_sys_fsconfig+0xad5/0x1060 fs/fsopen.c:314
>  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
>  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> [...]
> 
> JFS_SBI(ipbmap->i_sb)->bmap wasn't set to NULL after kfree() in
> dbUnmount().
> 
> Syzkaller uses faultinject to reproduce this KASAN double-free
> warning. The issue is triggered if either diMount() or dbMount() fail
> in jfs_remount(), since diUnmount() or dbUnmount() already happened in
> such a case - they will do double-free on next execution: jfs_umount
> or jfs_remount.
> 
> Tested on both upstream and jfs-next by syzkaller.
> 
> Reported-and-tested-by: syzbot+6a93efb725385bc4b2e9@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/000000000000471f2d05f1ce8bad@google.com/T/
> Link: https://syzkaller.appspot.com/bug?extid=6a93efb725385bc4b2e9
> Signed-off-by: Andrew Kanner <andrew.kanner@gmail.com>
> ---
>  fs/jfs/jfs_dmap.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index a14a0f18a4c4..88afd108c2dd 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -269,6 +269,7 @@ int dbUnmount(struct inode *ipbmap, int mounterror)
>  
>  	/* free the memory for the in-memory bmap. */
>  	kfree(bmp);
> +	JFS_SBI(ipbmap->i_sb)->bmap = NULL;
>  
>  	return (0);
>  }
> -- 
> 2.39.3
> 

Hi, Dave.
Are there any objections?
Or maybe suggestions on how to test both my patch and the patch from
Liu Shixin (some corner cases)?
Dave Kleikamp July 18, 2023, 4:17 p.m. UTC | #2 
On 7/18/23 10:39AM, Andrew Kanner wrote:
> On Sat, Jul 01, 2023 at 05:05:42PM +0300, Andrew Kanner wrote:
>> Syzkaller reported the following issue:
>> ==================================================================
>> BUG: KASAN: double-free in slab_free mm/slub.c:3787 [inline]
>> BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3800
>> Free of addr ffff888086408000 by task syz-executor.4/12750
>> [...]
>> Call Trace:
>>   <TASK>
>> [...]
>>   kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:482
>>   ____kasan_slab_free+0xfb/0x120
>>   kasan_slab_free include/linux/kasan.h:177 [inline]
>>   slab_free_hook mm/slub.c:1781 [inline]
>>   slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807
>>   slab_free mm/slub.c:3787 [inline]
>>   __kmem_cache_free+0x71/0x110 mm/slub.c:3800
>>   dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264
>>   jfs_umount+0x248/0x3b0 fs/jfs/jfs_umount.c:87
>>   jfs_put_super+0x86/0x190 fs/jfs/super.c:194
>>   generic_shutdown_super+0x130/0x310 fs/super.c:492
>>   kill_block_super+0x79/0xd0 fs/super.c:1386
>>   deactivate_locked_super+0xa7/0xf0 fs/super.c:332
>>   cleanup_mnt+0x494/0x520 fs/namespace.c:1291
>>   task_work_run+0x243/0x300 kernel/task_work.c:179
>>   resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
>>   exit_to_user_mode_loop+0x124/0x150 kernel/entry/common.c:171
>>   exit_to_user_mode_prepare+0xb2/0x140 kernel/entry/common.c:203
>>   __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
>>   syscall_exit_to_user_mode+0x26/0x60 kernel/entry/common.c:296
>>   do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
>>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
>> [...]
>>   </TASK>
>>
>> Allocated by task 13352:
>>   kasan_save_stack mm/kasan/common.c:45 [inline]
>>   kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
>>   ____kasan_kmalloc mm/kasan/common.c:371 [inline]
>>   __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380
>>   kmalloc include/linux/slab.h:580 [inline]
>>   dbMount+0x54/0x980 fs/jfs/jfs_dmap.c:164
>>   jfs_mount+0x1dd/0x830 fs/jfs/jfs_mount.c:121
>>   jfs_fill_super+0x590/0xc50 fs/jfs/super.c:556
>>   mount_bdev+0x26c/0x3a0 fs/super.c:1359
>>   legacy_get_tree+0xea/0x180 fs/fs_context.c:610
>>   vfs_get_tree+0x88/0x270 fs/super.c:1489
>>   do_new_mount+0x289/0xad0 fs/namespace.c:3145
>>   do_mount fs/namespace.c:3488 [inline]
>>   __do_sys_mount fs/namespace.c:3697 [inline]
>>   __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674
>>   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>>   do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
>>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
>>
>> Freed by task 13352:
>>   kasan_save_stack mm/kasan/common.c:45 [inline]
>>   kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
>>   kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:518
>>   ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
>>   kasan_slab_free include/linux/kasan.h:177 [inline]
>>   slab_free_hook mm/slub.c:1781 [inline]
>>   slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807
>>   slab_free mm/slub.c:3787 [inline]
>>   __kmem_cache_free+0x71/0x110 mm/slub.c:3800
>>   dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264
>>   jfs_mount_rw+0x545/0x740 fs/jfs/jfs_mount.c:247
>>   jfs_remount+0x3db/0x710 fs/jfs/super.c:454
>>   reconfigure_super+0x3bc/0x7b0 fs/super.c:935
>>   vfs_fsconfig_locked fs/fsopen.c:254 [inline]
>>   __do_sys_fsconfig fs/fsopen.c:439 [inline]
>>   __se_sys_fsconfig+0xad5/0x1060 fs/fsopen.c:314
>>   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>>   do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
>>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
>> [...]
>>
>> JFS_SBI(ipbmap->i_sb)->bmap wasn't set to NULL after kfree() in
>> dbUnmount().
>>
>> Syzkaller uses faultinject to reproduce this KASAN double-free
>> warning. The issue is triggered if either diMount() or dbMount() fail
>> in jfs_remount(), since diUnmount() or dbUnmount() already happened in
>> such a case - they will do double-free on next execution: jfs_umount
>> or jfs_remount.
>>
>> Tested on both upstream and jfs-next by syzkaller.
>>
>> Reported-and-tested-by: syzbot+6a93efb725385bc4b2e9@syzkaller.appspotmail.com
>> Closes: https://lore.kernel.org/all/000000000000471f2d05f1ce8bad@google.com/T/
>> Link: https://syzkaller.appspot.com/bug?extid=6a93efb725385bc4b2e9
>> Signed-off-by: Andrew Kanner <andrew.kanner@gmail.com>
>> ---
>>   fs/jfs/jfs_dmap.c | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
>> index a14a0f18a4c4..88afd108c2dd 100644
>> --- a/fs/jfs/jfs_dmap.c
>> +++ b/fs/jfs/jfs_dmap.c
>> @@ -269,6 +269,7 @@ int dbUnmount(struct inode *ipbmap, int mounterror)
>>   
>>   	/* free the memory for the in-memory bmap. */
>>   	kfree(bmp);
>> +	JFS_SBI(ipbmap->i_sb)->bmap = NULL;
>>   
>>   	return (0);
>>   }
>> -- 
>> 2.39.3
>>
> 
> Hi, Dave.
> Are there any objections?
> Or maybe suggestions on how to test both my patch and the patch from
> Liu Shixin (some corner cases)?

Sorry. I got behind. I'll try to catch up on these today (or very soon 
if something more urgent pops up).

Shaggy
Dave Kleikamp July 18, 2023, 7:46 p.m. UTC | #3 
On 7/18/23 10:39AM, Andrew Kanner wrote:
> On Sat, Jul 01, 2023 at 05:05:42PM +0300, Andrew Kanner wrote:
>> Syzkaller reported the following issue:
>> ==================================================================
>> BUG: KASAN: double-free in slab_free mm/slub.c:3787 [inline]
>> BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3800
>> Free of addr ffff888086408000 by task syz-executor.4/12750
>> [...]
>> Call Trace:
>>   <TASK>
>> [...]
>>   kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:482
>>   ____kasan_slab_free+0xfb/0x120
>>   kasan_slab_free include/linux/kasan.h:177 [inline]
>>   slab_free_hook mm/slub.c:1781 [inline]
>>   slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807
>>   slab_free mm/slub.c:3787 [inline]
>>   __kmem_cache_free+0x71/0x110 mm/slub.c:3800
>>   dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264
>>   jfs_umount+0x248/0x3b0 fs/jfs/jfs_umount.c:87
>>   jfs_put_super+0x86/0x190 fs/jfs/super.c:194
>>   generic_shutdown_super+0x130/0x310 fs/super.c:492
>>   kill_block_super+0x79/0xd0 fs/super.c:1386
>>   deactivate_locked_super+0xa7/0xf0 fs/super.c:332
>>   cleanup_mnt+0x494/0x520 fs/namespace.c:1291
>>   task_work_run+0x243/0x300 kernel/task_work.c:179
>>   resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
>>   exit_to_user_mode_loop+0x124/0x150 kernel/entry/common.c:171
>>   exit_to_user_mode_prepare+0xb2/0x140 kernel/entry/common.c:203
>>   __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
>>   syscall_exit_to_user_mode+0x26/0x60 kernel/entry/common.c:296
>>   do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
>>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
>> [...]
>>   </TASK>
>>
>> Allocated by task 13352:
>>   kasan_save_stack mm/kasan/common.c:45 [inline]
>>   kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
>>   ____kasan_kmalloc mm/kasan/common.c:371 [inline]
>>   __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380
>>   kmalloc include/linux/slab.h:580 [inline]
>>   dbMount+0x54/0x980 fs/jfs/jfs_dmap.c:164
>>   jfs_mount+0x1dd/0x830 fs/jfs/jfs_mount.c:121
>>   jfs_fill_super+0x590/0xc50 fs/jfs/super.c:556
>>   mount_bdev+0x26c/0x3a0 fs/super.c:1359
>>   legacy_get_tree+0xea/0x180 fs/fs_context.c:610
>>   vfs_get_tree+0x88/0x270 fs/super.c:1489
>>   do_new_mount+0x289/0xad0 fs/namespace.c:3145
>>   do_mount fs/namespace.c:3488 [inline]
>>   __do_sys_mount fs/namespace.c:3697 [inline]
>>   __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674
>>   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>>   do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
>>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
>>
>> Freed by task 13352:
>>   kasan_save_stack mm/kasan/common.c:45 [inline]
>>   kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
>>   kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:518
>>   ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
>>   kasan_slab_free include/linux/kasan.h:177 [inline]
>>   slab_free_hook mm/slub.c:1781 [inline]
>>   slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807
>>   slab_free mm/slub.c:3787 [inline]
>>   __kmem_cache_free+0x71/0x110 mm/slub.c:3800
>>   dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264
>>   jfs_mount_rw+0x545/0x740 fs/jfs/jfs_mount.c:247
>>   jfs_remount+0x3db/0x710 fs/jfs/super.c:454
>>   reconfigure_super+0x3bc/0x7b0 fs/super.c:935
>>   vfs_fsconfig_locked fs/fsopen.c:254 [inline]
>>   __do_sys_fsconfig fs/fsopen.c:439 [inline]
>>   __se_sys_fsconfig+0xad5/0x1060 fs/fsopen.c:314
>>   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>>   do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
>>   entry_SYSCALL_64_after_hwframe+0x63/0xcd
>> [...]
>>
>> JFS_SBI(ipbmap->i_sb)->bmap wasn't set to NULL after kfree() in
>> dbUnmount().
>>
>> Syzkaller uses faultinject to reproduce this KASAN double-free
>> warning. The issue is triggered if either diMount() or dbMount() fail
>> in jfs_remount(), since diUnmount() or dbUnmount() already happened in
>> such a case - they will do double-free on next execution: jfs_umount
>> or jfs_remount.
>>
>> Tested on both upstream and jfs-next by syzkaller.
>>
>> Reported-and-tested-by: syzbot+6a93efb725385bc4b2e9@syzkaller.appspotmail.com
>> Closes: https://lore.kernel.org/all/000000000000471f2d05f1ce8bad@google.com/T/
>> Link: https://syzkaller.appspot.com/bug?extid=6a93efb725385bc4b2e9
>> Signed-off-by: Andrew Kanner <andrew.kanner@gmail.com>
>> ---
>>   fs/jfs/jfs_dmap.c | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
>> index a14a0f18a4c4..88afd108c2dd 100644
>> --- a/fs/jfs/jfs_dmap.c
>> +++ b/fs/jfs/jfs_dmap.c
>> @@ -269,6 +269,7 @@ int dbUnmount(struct inode *ipbmap, int mounterror)
>>   
>>   	/* free the memory for the in-memory bmap. */
>>   	kfree(bmp);
>> +	JFS_SBI(ipbmap->i_sb)->bmap = NULL;
>>   
>>   	return (0);
>>   }
>> -- 
>> 2.39.3
>>
> 
> Hi, Dave.
> Are there any objections?
> Or maybe suggestions on how to test both my patch and the patch from
> Liu Shixin (some corner cases)?

Looks good. Applied.

Thanks,
Shaggy
diff mbox series

Patch

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index a14a0f18a4c4..88afd108c2dd 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -269,6 +269,7 @@  int dbUnmount(struct inode *ipbmap, int mounterror)
 
 	/* free the memory for the in-memory bmap. */
 	kfree(bmp);
+	JFS_SBI(ipbmap->i_sb)->bmap = NULL;
 
 	return (0);
 }