From patchwork Thu Dec 1 12:46:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Liu Shixin X-Patchwork-Id: 28343 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp223799wrr; Thu, 1 Dec 2022 04:10:40 -0800 (PST) X-Google-Smtp-Source: AA0mqf6xC5GF+iYu48B3vTxOOA/kX94cZdmwXmvsCF+ct7WHmGaAVJWN6P+3Yc/Q1V+nNR+UJkeV X-Received: by 2002:a63:5910:0:b0:477:2793:f821 with SMTP id n16-20020a635910000000b004772793f821mr57800316pgb.150.1669896640469; Thu, 01 Dec 2022 04:10:40 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669896640; cv=none; d=google.com; s=arc-20160816; b=JMxLTQKKyCMoUx1U+s494T2eYONnLUpqIN3AYFgszHrIWbjU7Q02/limawZ3/188oB XjAHn1FZXyS3LBxD1Lhg+N/EyvZyAPLxGUYJED759eWPZRpTEJVOMR9WX1JZ0Mb4oXrp 9EVK/ESTbdfw/05Dg2TIDncgJUMnjcEd1k8zmZk6/hExuxXiCkpGwjcJFArYc9jioEw7 XJ/pKeC2qC5+Acj5SVFwqeIAPhOa82MZsr7zeWRL9J/LUPM54x4m4ME6+XU4Xn63Veri qc5wdznLKWOzYQcZAqdL8NRqeiCg54d68MkIfRNXzM8edkDhdtLjvNFkQvTxI2mURFKe g3Cg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=Czct4PkIVDymE/Vbje8zNfdVjzThSA0bn1oTaROsp3U=; b=XAK2gmgNUmonXutclqxuh+sEGFAKhEBr4MjSABp+xYdEvx6lnGPLxGVjkCOl1H/V+D aWqEFMPu8IpQX4YYzvoC3nImxuzNGRHNuJoH8YA2LfHc0aFYT5oUOvg/yvvMcwj49oUC ff53BJeNP2bL/5Th9XgQ6PKx4QulKLyRI5R9q1ZWi0GmnIQkDgDCn/P32Y74RoioiavE S+6F+5LRweMnVj+/9iHtYJFnFCw0OpRSu3YRFx8qwN24L0PVjiuix5eOXRqS+bHDXZDo Izf21MVFGGjWLjmUXEBWduaeJ1ztQN93r8Y8GQc31jAVe25TJA+rDeNwfEq+7kqM/GQc dfMQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id m6-20020a170902f64600b0018659963cdcsi4204594plg.514.2022.12.01.04.10.25; Thu, 01 Dec 2022 04:10:40 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231235AbiLAL7d (ORCPT + 99 others); Thu, 1 Dec 2022 06:59:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47234 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230063AbiLAL7a (ORCPT ); Thu, 1 Dec 2022 06:59:30 -0500 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EFCD391C10 for ; Thu, 1 Dec 2022 03:59:29 -0800 (PST) Received: from dggpemm100009.china.huawei.com (unknown [172.30.72.54]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4NNF3B1FYzzmVxm; Thu, 1 Dec 2022 19:58:46 +0800 (CST) Received: from huawei.com (10.175.113.32) by dggpemm100009.china.huawei.com (7.185.36.113) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 1 Dec 2022 19:59:28 +0800 From: Liu Shixin To: Dave Kleikamp CC: , , Liu Shixin Subject: [PATCH] jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount Date: Thu, 1 Dec 2022 20:46:28 +0800 Message-ID: <20221201124628.603505-1-liushixin2@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.175.113.32] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To dggpemm100009.china.huawei.com (7.185.36.113) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1751013539592736278?= X-GMAIL-MSGID: =?utf-8?q?1751013539592736278?= syzbot found an invalid-free in diUnmount: BUG: KASAN: double-free in slab_free mm/slub.c:3661 [inline] BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3674 Free of addr ffff88806f410000 by task syz-executor131/3632 CPU: 0 PID: 3632 Comm: syz-executor131 Not tainted 6.1.0-rc7-syzkaller-00012-gca57f02295f1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:460 ____kasan_slab_free+0xfb/0x120 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1724 [inline] slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1750 slab_free mm/slub.c:3661 [inline] __kmem_cache_free+0x71/0x110 mm/slub.c:3674 diUnmount+0xef/0x100 fs/jfs/jfs_imap.c:195 jfs_umount+0x108/0x370 fs/jfs/jfs_umount.c:63 jfs_put_super+0x86/0x190 fs/jfs/super.c:194 generic_shutdown_super+0x130/0x310 fs/super.c:492 kill_block_super+0x79/0xd0 fs/super.c:1428 deactivate_locked_super+0xa7/0xf0 fs/super.c:332 cleanup_mnt+0x494/0x520 fs/namespace.c:1186 task_work_run+0x243/0x300 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0x664/0x2070 kernel/exit.c:820 do_group_exit+0x1fd/0x2b0 kernel/exit.c:950 __do_sys_exit_group kernel/exit.c:961 [inline] __se_sys_exit_group kernel/exit.c:959 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:959 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] JFS_IP(ipimap)->i_imap is not setting to NULL after free in diUnmount. If jfs_remount() free JFS_IP(ipimap)->i_imap but then failed at diMount(). JFS_IP(ipimap)->i_imap will be freed once again. Fix this problem by setting JFS_IP(ipimap)->i_imap to NULL after free. Reported-by: syzbot+90a11e6b1e810785c6ff@syzkaller.appspotmail.com Signed-off-by: Liu Shixin --- fs/jfs/jfs_imap.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c index 799d3837e7c2..4899663996d8 100644 --- a/fs/jfs/jfs_imap.c +++ b/fs/jfs/jfs_imap.c @@ -193,6 +193,7 @@ int diUnmount(struct inode *ipimap, int mounterror) * free in-memory control structure */ kfree(imap); + JFS_IP(ipimap)->i_imap = NULL; return (0); }