kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/fs/xfs
History
Yuto Ohnuki 19437e4f7b xfs: save ailp before dropping the AIL lock in push callbacks 
[ Upstream commit 394d70b86f ]

In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock
is dropped to perform buffer IO. Once the cluster buffer no longer
protects the log item from reclaim, the log item may be freed by
background reclaim or the dquot shrinker. The subsequent spin_lock()
call dereferences lip->li_ailp, which is a use-after-free.

Fix this by saving the ailp pointer in a local variable while the AIL
lock is held and the log item is guaranteed to be valid.

Reported-by: syzbot+652af2b3c5569c4ab63c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=652af2b3c5569c4ab63c
Fixes: 90c60e1640 ("xfs: xfs_iflush() is no longer necessary")
Cc: stable@vger.kernel.org # v5.9
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Yuto Ohnuki <ytohnuki@amazon.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-04-18 10:33:38 +02:00
..
libxfs xfs: fix freemap adjustments when adding xattrs to leaf blocks 2026-03-04 07:20:31 -05:00
scrub xfs: fix remote xattr valuelblk check 2026-03-04 07:20:31 -05:00
Kconfig xfs: fix Kconfig asking about XFS_SUPPORT_V4 when XFS_FS=n 2020-10-16 15:34:28 -07:00
kmem.c xfs: replace kmem_alloc_large() with kvmalloc() 2021-08-09 15:57:43 -07:00
kmem.h xfs: replace kmem_alloc_large() with kvmalloc() 2021-08-09 15:57:43 -07:00
Makefile xfs: refactor log recovery item sorting into a generic dispatch structure 2020-05-08 08:49:58 -07:00
mrlock.h xfs: convert to SPDX license tags 2018-06-06 14:17:53 -07:00
xfs.h xfs: remove b_last_holder & associated macros 2018-08-12 08:37:31 -07:00
xfs_acl.c overlayfs update for 5.15 2021-09-02 09:21:27 -07:00
xfs_acl.h vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
xfs_aops.c xfs: punch out data fork delalloc blocks on COW writeback failure 2022-07-02 16:41:13 +02:00
xfs_aops.h xfs: add a xfs_inode_buftarg helper 2019-10-28 08:37:54 -07:00
xfs_attr_inactive.c xfs: fix use-after-free in xattr node block inactivation 2023-11-28 16:56:25 +00:00
xfs_attr_list.c xfs: replace XFS_FORCED_SHUTDOWN with xfs_is_shutdown 2021-08-19 10:07:13 -07:00
xfs_bio_io.c xfs: drop async cache flushes from CIL commits. 2022-07-21 21:24:15 +02:00
xfs_bmap_item.c xfs: fix potential log item leak 2023-02-22 12:57:03 +01:00
xfs_bmap_item.h xfs: refactor intent item RECOVERED flag into the log item 2020-05-08 08:50:01 -07:00
xfs_bmap_util.c xfs: set prealloc flag in xfs_alloc_file_space() 2023-03-17 08:49:00 +01:00
xfs_bmap_util.h xfs: simplify xfs_iomap_eof_align_last_fsb 2019-11-03 10:22:30 -08:00
xfs_buf.c New code for 5.15: 2021-09-02 08:26:03 -07:00
xfs_buf.h xfs: rename buffer cache index variable b_bn 2021-08-19 10:07:15 -07:00
xfs_buf_item.c xfs: fix a memory leak in xfs_buf_item_init() 2026-01-19 13:10:07 +01:00
xfs_buf_item.h xfs: move the buffer retry logic to xfs_buf.c 2020-09-15 20:52:38 -07:00
xfs_buf_item_recover.c xfs: convert buf_cancel_table allocation to kmalloc_array 2023-11-28 16:56:25 +00:00
xfs_dir2_readdir.c xfs: replace XFS_FORCED_SHUTDOWN with xfs_is_shutdown 2021-08-19 10:07:13 -07:00
xfs_discard.c xfs: convert mount flags to features 2021-08-19 10:07:12 -07:00
xfs_discard.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xfs_dquot.c xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_dquot.h xfs: queue inactivation immediately when quota is nearing enforcement 2021-08-09 10:52:18 -07:00
xfs_dquot_item.c xfs: save ailp before dropping the AIL lock in push callbacks 2026-04-18 10:33:38 +02:00
xfs_dquot_item.h xfs: remove support for disabling quota accounting on a mounted file system 2021-08-06 11:05:36 -07:00
xfs_dquot_item_recover.c xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_error.c xfs: fix memory leak in xfs_errortag_init 2023-11-28 16:56:26 +00:00
xfs_error.h xfs: add trace point for fs shutdown 2021-08-18 18:46:00 -07:00
xfs_export.c xfs: convert remaining mount flags to state flags 2021-08-19 10:07:13 -07:00
xfs_export.h xfs: convert to SPDX license tags 2018-06-06 14:17:53 -07:00
xfs_extent_busy.c xfs: pass perags through to the busy extent code 2021-06-02 10:48:24 +10:00
xfs_extent_busy.h xfs: pass perags through to the busy extent code 2021-06-02 10:48:24 +10:00
xfs_extfree_item.c xfs: use kmem_cache_free() for kmem_cache objects 2022-07-02 16:41:12 +02:00
xfs_extfree_item.h xfs: refactor intent item RECOVERED flag into the log item 2020-05-08 08:50:01 -07:00
xfs_file.c xfs: don't drop errno values when we fail to ficlone the entire range 2024-12-19 18:07:18 +01:00
xfs_filestream.c xfs: fix soft lockup via spinning in filestream ag selection loop 2022-08-25 11:40:48 +02:00
xfs_filestream.h xfs: convert mount flags to features 2021-08-19 10:07:12 -07:00
xfs_fsmap.c xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_fsmap.h xfs: fix deadlock and streamline xfs_getfsmap performance 2020-10-07 08:40:29 -07:00
xfs_fsops.c xfs: short circuit xfs_growfs_data_private() if delta is zero 2025-10-02 13:38:59 +02:00
xfs_fsops.h xfs: get rid of xfs_growfs_{data,log}_t 2021-02-03 09:18:50 -08:00
xfs_globals.c xfs: consolidate the eofblocks and cowblocks workers 2021-02-03 09:18:49 -08:00
xfs_health.c xfs: replace XFS_FORCED_SHUTDOWN with xfs_is_shutdown 2021-08-19 10:07:13 -07:00
xfs_icache.c xfs: fix xfs_inodegc_stop racing with mod_delayed_work 2023-10-06 13:18:10 +02:00
xfs_icache.h xfs: introduce xfs_inodegc_push() 2023-10-06 13:18:09 +02:00
xfs_icreate_item.c xfs: fix potential log item leak 2023-02-22 12:57:03 +01:00
xfs_icreate_item.h xfs: convert to SPDX license tags 2018-06-06 14:17:53 -07:00
xfs_inode.c xfs: allow inode inactivation during a ro mount log recovery 2025-06-27 11:05:22 +01:00
xfs_inode.h New code for 5.15: 2021-09-02 08:26:03 -07:00
xfs_inode_item.c xfs: save ailp before dropping the AIL lock in push callbacks 2026-04-18 10:33:38 +02:00
xfs_inode_item.h xfs: xfs_log_force_lsn isn't passed a LSN 2021-06-21 10:12:33 -07:00
xfs_inode_item_recover.c xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_ioctl.c xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP* 2022-08-25 11:40:48 +02:00
xfs_ioctl.h xfs: prevent a WARN_ONCE() in xfs_ioc_attr_list() 2022-07-29 17:25:09 +02:00
xfs_ioctl32.c xfs: convert xfs_fs_geometry to use mount feature checks 2021-08-19 10:07:13 -07:00
xfs_ioctl32.h xfs: convert to fileattr 2021-04-12 15:04:29 +02:00
xfs_iomap.c xfs: only set IOMAP_F_SHARED when providing a srcmap to a write 2021-08-23 17:32:51 -07:00
xfs_iomap.h xfs: simplify the xfs_iomap_write_direct calling 2019-11-03 10:22:30 -08:00
xfs_iops.c xfs: don't expose internal symlink metadata buffers to the vfs 2023-10-25 11:58:54 +02:00
xfs_iops.h xfs: remove xfs_setattr_time() declaration 2023-03-17 08:49:04 +01:00
xfs_itable.c xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_itable.h xfs: support idmapped mounts 2021-01-24 14:43:46 +01:00
xfs_iwalk.c xfs: avoid buffer deadlocks when walking fs inodes 2021-08-09 11:13:16 -07:00
xfs_iwalk.h xfs: remove all *_ITER_CONTINUE values 2019-08-30 22:43:56 -07:00
xfs_linux.h xfs: drop async cache flushes from CIL commits. 2022-07-21 21:24:15 +02:00
xfs_log.c xfs: fix undersized l_iclog_roundoff values 2026-04-18 10:33:16 +02:00
xfs_log.h xfs: AIL needs asynchronous CIL forcing 2021-08-16 12:09:30 -07:00
xfs_log_cil.c xfs: drop async cache flushes from CIL commits. 2022-07-21 21:24:15 +02:00
xfs_log_priv.h xfs: fix log CRC mismatches between i386 and other architectures 2025-10-29 14:03:13 +01:00
xfs_log_recover.c xfs: fix log CRC mismatches between i386 and other architectures 2025-10-29 14:03:13 +01:00
xfs_message.c xfs: refactor ratelimited buffer error messages into helper 2020-05-07 08:27:46 -07:00
xfs_message.h once: implement DO_ONCE_LITE for non-fast-path "do once" functionality 2021-06-28 15:54:57 -07:00
xfs_mount.c xfs: stop reclaim before pushing AIL during unmount 2026-04-18 10:33:27 +02:00
xfs_mount.h xfs: check that per-cpu inodegc workers actually run on that cpu 2023-10-06 13:18:10 +02:00
xfs_mru_cache.c xfs: set WQ_SYSFS on all workqueues in debug mode 2021-02-03 09:18:49 -08:00
xfs_mru_cache.h xfs: convert to SPDX license tags 2018-06-06 14:17:53 -07:00
xfs_ondisk.h xfs: fix log CRC mismatches between i386 and other architectures 2025-10-29 14:03:13 +01:00
xfs_pnfs.c xfs: remove XFS_PREALLOC_SYNC 2023-03-17 08:48:59 +01:00
xfs_pnfs.h xfs: prepare xfs_break_layouts() for another layout type 2018-05-22 07:19:08 -07:00
xfs_pwork.c xfs: increase the default parallelism levels of pwork clients 2021-02-03 09:18:49 -08:00
xfs_pwork.h xfs: increase the default parallelism levels of pwork clients 2021-02-03 09:18:49 -08:00
xfs_qm.c xfs: fix intermittent hang during quotacheck 2023-11-28 16:56:26 +00:00
xfs_qm.h xfs: remove support for disabling quota accounting on a mounted file system 2021-08-06 11:05:36 -07:00
xfs_qm_bhv.c xfs: don't over-report free space or inodes in statvfs 2025-03-13 12:50:21 +01:00
xfs_qm_syscalls.c xfs: introduce xfs_inodegc_push() 2023-10-06 13:18:09 +02:00
xfs_quota.h xfs: queue inactivation immediately when quota is nearing enforcement 2021-08-09 10:52:18 -07:00
xfs_quotaops.c xfs: remove the active vs running quota differentiation 2021-08-06 11:05:37 -07:00
xfs_refcount_item.c xfs: fix potential log item leak 2023-02-22 12:57:03 +01:00
xfs_refcount_item.h xfs: refactor intent item RECOVERED flag into the log item 2020-05-08 08:50:01 -07:00
xfs_reflink.c xfs: Fix false ENOSPC when performing direct write on a delalloc extent in cow fork 2023-11-28 16:56:26 +00:00
xfs_reflink.h xfs: convert xfs_sb_version_has checks to use mount features 2021-08-19 10:07:14 -07:00
xfs_rmap_item.c xfs: fix potential log item leak 2023-02-22 12:57:03 +01:00
xfs_rmap_item.h xfs: refactor intent item RECOVERED flag into the log item 2020-05-08 08:50:01 -07:00
xfs_rtalloc.c xfs: replace xfs_sb_version checks with feature flag checks 2021-08-19 10:07:12 -07:00
xfs_rtalloc.h xfs: make the record pointer passed to query_range functions const 2021-08-18 18:46:01 -07:00
xfs_stats.c xfs: periodically relog deferred intent items 2020-10-07 08:40:28 -07:00
xfs_stats.h xfs: periodically relog deferred intent items 2020-10-07 08:40:28 -07:00
xfs_super.c xfs: always warn about deprecated mount options 2025-10-29 14:03:15 +01:00
xfs_super.h xfs: remove xfs_blkdev_issue_flush 2021-06-21 10:05:46 -07:00
xfs_symlink.c xfs: don't expose internal symlink metadata buffers to the vfs 2023-10-25 11:58:54 +02:00
xfs_symlink.h xfs: support idmapped mounts 2021-01-24 14:43:46 +01:00
xfs_sysctl.c xfs: restore speculative_cow_prealloc_lifetime sysctl 2021-02-24 10:16:08 -08:00
xfs_sysctl.h xfs: consolidate the eofblocks and cowblocks workers 2021-02-03 09:18:49 -08:00
xfs_sysfs.c xfs: AIL needs asynchronous CIL forcing 2021-08-16 12:09:30 -07:00
xfs_sysfs.h xfs: Fix unreferenced object reported by kmemleak in xfs_sysfs_init() 2023-11-28 16:56:26 +00:00
xfs_trace.c xfs: add trace point for fs shutdown 2021-08-18 18:46:00 -07:00
xfs_trace.h xfs: introduce xfs_inodegc_push() 2023-10-06 13:18:09 +02:00
xfs_trans.c xfs: reserve quota for dir expansion when linking/unlinking files 2022-08-25 11:40:47 +02:00
xfs_trans.h xfs: reserve quota for dir expansion when linking/unlinking files 2022-08-25 11:40:47 +02:00
xfs_trans_ail.c xfs: replace XFS_FORCED_SHUTDOWN with xfs_is_shutdown 2021-08-19 10:07:13 -07:00
xfs_trans_buf.c xfs: introduce xfs_buf_daddr() 2021-08-19 10:07:14 -07:00
xfs_trans_dquot.c xfs: revert "xfs: actually bump warning counts when we send warnings" 2022-08-25 11:40:48 +02:00
xfs_trans_priv.h xfs: refactor adding recovered intent items to the log 2020-05-08 08:50:00 -07:00
xfs_xattr.c xfs: prevent metadata files from being inactivated 2021-03-25 16:47:50 -07:00