Skip to contentSkip to conversation

gfs2: fix use-after-free in gfs2_qd_dealloc

PATCH Applied Tristan Madani 2 participants 3 messages May 1 – May 4

Subsystems (2)
Stable branch GFS2 file system
lore
Share & tools
lore

Tristan Madani

author
#0 lore raw

PATCH 1/1 gfs2: fix use-after-free in gfs2_qd_dealloc

From: Tristan Madani <[email protected]>

gfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(), accesses the superblock object sdp through qd->qd_sbd after freeing qd. It does so to decrement sd_quota_count and wake up sd_kill_wait.

However, by the time the RCU callback runs, gfs2_put_super() may have already freed sdp via free_sbd(). This can happen when gfs2_quota_cleanup() is called during unmount: it disposes of quota objects via call_rcu() and then waits on sd_kill_wait with a 60-second timeout. If the timeout expires, or if gfs2_gl_hash_clear() triggers additional qd_put() calls that schedule more RCU callbacks after the wait completes, gfs2_put_super() will proceed to free the superblock while RCU callbacks referencing it are still pending.

Add an rcu_barrier() before free_sbd() in gfs2_put_super() to ensure all pending RCU callbacks (including gfs2_qd_dealloc) have completed before the superblock is freed.

Fixes a475c5dd16e5 ("gfs2: Free quota data objects synchronously")
Reported-by [email protected]
Closes https://syzkaller.appspot.com/bug?extid=42a37bf8045847d8f9d2
Tested-by [email protected]
Cc [email protected]
Signed-off-by Tristan Madani <[email protected]>
---
 fs/gfs2/super.c | 1 +
 1 file changed, 1 insertion(+)
fs/gfs2/super.c +1 -0
index a2ea121331f18..4d854556b5299 100644
@@ -643,6 +643,7 @@ static void gfs2_put_super(struct super_block *sb)
 	gfs2_delete_debugfs_file(sdp);
 
 	gfs2_sys_fs_del(sdp);
+	rcu_barrier();
 	free_sbd(sdp);
 }
Signature · 1 line
2.47.3
maintainer Applied
#1 lore raw
Quoted 42 lines · Tristan Madani

From: Tristan Madani <[email protected]>

gfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(), accesses the superblock object sdp through qd->qd_sbd after freeing qd. It does so to decrement sd_quota_count and wake up sd_kill_wait.

However, by the time the RCU callback runs, gfs2_put_super() may have already freed sdp via free_sbd(). This can happen when gfs2_quota_cleanup() is called during unmount: it disposes of quota objects via call_rcu() and then waits on sd_kill_wait with a 60-second timeout. If the timeout expires, or if gfs2_gl_hash_clear() triggers additional qd_put() calls that schedule more RCU callbacks after the wait completes, gfs2_put_super() will proceed to free the superblock while RCU callbacks referencing it are still pending.

Add an rcu_barrier() before free_sbd() in gfs2_put_super() to ensure all pending RCU callbacks (including gfs2_qd_dealloc) have completed before the superblock is freed.

Fixes a475c5dd16e5 ("gfs2: Free quota data objects synchronously")
Reported-by [email protected]
Closes https://syzkaller.appspot.com/bug?extid=42a37bf8045847d8f9d2
Tested-by [email protected]
Cc [email protected]
Signed-off-by Tristan Madani <[email protected]>
---
 fs/gfs2/super.c | 1 +
 1 file changed, 1 insertion(+)
fs/gfs2/super.c +1 -1
index a2ea121331f18..4d854556b5299 100644
@@ -643,6 +643,7 @@ static void gfs2_put_super(struct super_block *sb)
        gfs2_delete_debugfs_file(sdp);
 
        gfs2_sys_fs_del(sdp);
+       rcu_barrier();
        free_sbd(sdp);
 }
 
--
Quoted 2 lines

2.47.3

Applied, thanks.

Andreas