Link: https://www.cve.org/CVERecord/?id=CVE-2023-52760
[PATCH 5.10 1/2] gfs2: make function gfs2_make_fs_ro() to void type [PATCH 5.10 2/2] gfs2: Fix slab-use-after-free in gfs2_qd_dealloc
From: Yang Li yang.lee@linux.alibaba.com
commit eb602521f43876b3f76c4686de596c9804977228 upstream.
It fixes the following warning detected by coccinelle: ./fs/gfs2/super.c:592:5-10: Unneeded variable: "error". Return "0" on line 628
Reported-by: Abaci Robot abaci@linux.alibaba.com Signed-off-by: Yang Li yang.lee@linux.alibaba.com Signed-off-by: Bob Peterson rpeterso@redhat.com Signed-off-by: Andreas Gruenbacher agruenba@redhat.com Signed-off-by: Vasiliy Kovalev kovalev@altlinux.org --- fs/gfs2/ops_fstype.c | 4 +--- fs/gfs2/super.c | 10 ++-------- fs/gfs2/super.h | 2 +- fs/gfs2/util.c | 2 +- 4 files changed, 5 insertions(+), 13 deletions(-)
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c index 648f7336043f6a..9fcb86d1a922a8 100644 --- a/fs/gfs2/ops_fstype.c +++ b/fs/gfs2/ops_fstype.c @@ -1564,9 +1564,7 @@ static int gfs2_reconfigure(struct fs_context *fc) return -EINVAL;
if (fc->sb_flags & SB_RDONLY) { - error = gfs2_make_fs_ro(sdp); - if (error) - errorfc(fc, "unable to remount read-only"); + gfs2_make_fs_ro(sdp); } else { error = gfs2_make_fs_rw(sdp); if (error) diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c index 8cf4ef61cdc41d..a9e3956a5b4698 100644 --- a/fs/gfs2/super.c +++ b/fs/gfs2/super.c @@ -555,9 +555,8 @@ static void gfs2_dirty_inode(struct inode *inode, int flags) * Returns: errno */
-int gfs2_make_fs_ro(struct gfs2_sbd *sdp) +void gfs2_make_fs_ro(struct gfs2_sbd *sdp) { - int error = 0; int log_write_allowed = test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags);
gfs2_flush_delete_work(sdp); @@ -592,8 +591,6 @@ int gfs2_make_fs_ro(struct gfs2_sbd *sdp)
if (!log_write_allowed) sdp->sd_vfs->s_flags |= SB_RDONLY; - - return error; }
/** @@ -605,7 +602,6 @@ int gfs2_make_fs_ro(struct gfs2_sbd *sdp) static void gfs2_put_super(struct super_block *sb) { struct gfs2_sbd *sdp = sb->s_fs_info; - int error; struct gfs2_jdesc *jd;
/* No more recovery requests */ @@ -626,9 +622,7 @@ static void gfs2_put_super(struct super_block *sb) spin_unlock(&sdp->sd_jindex_spin);
if (!sb_rdonly(sb)) { - error = gfs2_make_fs_ro(sdp); - if (error) - gfs2_io_error(sdp); + gfs2_make_fs_ro(sdp); } WARN_ON(gfs2_withdrawing(sdp));
diff --git a/fs/gfs2/super.h b/fs/gfs2/super.h index c9fb2a65418137..c61586ca61ff9b 100644 --- a/fs/gfs2/super.h +++ b/fs/gfs2/super.h @@ -30,7 +30,7 @@ extern int gfs2_lookup_in_master_dir(struct gfs2_sbd *sdp, char *filename, struct gfs2_inode **ipp);
extern int gfs2_make_fs_rw(struct gfs2_sbd *sdp); -extern int gfs2_make_fs_ro(struct gfs2_sbd *sdp); +extern void gfs2_make_fs_ro(struct gfs2_sbd *sdp); extern void gfs2_online_uevent(struct gfs2_sbd *sdp); extern int gfs2_statfs_init(struct gfs2_sbd *sdp); extern void gfs2_statfs_change(struct gfs2_sbd *sdp, s64 total, s64 free, diff --git a/fs/gfs2/util.c b/fs/gfs2/util.c index d11152dedb803e..00cb912b4744c4 100644 --- a/fs/gfs2/util.c +++ b/fs/gfs2/util.c @@ -161,7 +161,7 @@ static void signal_our_withdraw(struct gfs2_sbd *sdp) ret = 0; } if (!ret) - ret = gfs2_make_fs_ro(sdp); + gfs2_make_fs_ro(sdp); gfs2_freeze_unlock(&freeze_gh); }
From: Juntong Deng juntong.deng@outlook.com
commit bdcb8aa434c6d36b5c215d02a9ef07551be25a37 upstream.
In gfs2_put_super(), whether withdrawn or not, the quota should be cleaned up by gfs2_quota_cleanup().
Otherwise, struct gfs2_sbd will be freed before gfs2_qd_dealloc (rcu callback) has run for all gfs2_quota_data objects, resulting in use-after-free.
Also, gfs2_destroy_threads() and gfs2_quota_cleanup() is already called by gfs2_make_fs_ro(), so in gfs2_put_super(), after calling gfs2_make_fs_ro(), there is no need to call them again.
Reported-by: syzbot+29c47e9e51895928698c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=29c47e9e51895928698c Signed-off-by: Juntong Deng juntong.deng@outlook.com Signed-off-by: Andreas Gruenbacher agruenba@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Clayton Casciato majortomtosourcecontrol@gmail.com (cherry picked from commit 7ad4e0a4f61c57c3ca291ee010a9d677d0199fba) Signed-off-by: Vasiliy Kovalev kovalev@altlinux.org --- fs/gfs2/super.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c index a9e3956a5b4698..d4399bec7b5b12 100644 --- a/fs/gfs2/super.c +++ b/fs/gfs2/super.c @@ -623,6 +623,8 @@ static void gfs2_put_super(struct super_block *sb)
if (!sb_rdonly(sb)) { gfs2_make_fs_ro(sdp); + } else { + gfs2_quota_cleanup(sdp); } WARN_ON(gfs2_withdrawing(sdp));
linux-stable-mirror@lists.linaro.org
-
Vasiliy Kovalev