Messages in this thread Patch in this message | | | From | Edward Adam Davis <> | Subject | Re: [syzbot] [gfs2?] KASAN: slab-use-after-free Read in gfs2_invalidate_folio | Date | Sat, 13 Apr 2024 22:48:43 +0800 |
| |
please test uaf in gfs2_invalidate_folio
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git e8c39d0f57f3
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c index 974aca9c8ea8..4ae5e73b6992 100644 --- a/fs/gfs2/aops.c +++ b/fs/gfs2/aops.c @@ -613,6 +613,7 @@ static void gfs2_discard(struct gfs2_sbd *sdp, struct buffer_head *bh) gfs2_log_lock(sdp); clear_buffer_dirty(bh); bd = bh->b_private; + printk("bh: %p, bd: %p, %s\n", bh, bd, __func__); if (bd) { if (!list_empty(&bd->bd_list) && !buffer_pinned(bh)) list_del_init(&bd->bd_list); diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c index 8cddf955ebc0..d05decef6af5 100644 --- a/fs/gfs2/log.c +++ b/fs/gfs2/log.c @@ -1007,6 +1007,7 @@ static void trans_drain(struct gfs2_trans *tr) { struct gfs2_bufdata *bd; struct list_head *head; + struct buffer_head *bh; if (!tr) return; @@ -1022,6 +1023,9 @@ static void trans_drain(struct gfs2_trans *tr) head = &tr->tr_databuf; while (!list_empty(head)) { bd = list_first_entry(head, struct gfs2_bufdata, bd_list); + bh = container_of((void *)bd, struct buffer_head, b_private); + printk("bh: %p, bd: %p, %s\n", bh, bd, __func__); + bh->b_private = NULL; list_del_init(&bd->bd_list); if (!list_empty(&bd->bd_ail_st_list)) gfs2_remove_from_ail(bd);
| |