iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xfs: dquot shrinker doesn't check for XFS_DQFLAG_FREEING

Browse Source 
Resulting in a UAF if the shrinker races with some other dquot
freeing mechanism that sets XFS_DQFLAG_FREEING before the dquot is
removed from the LRU. This can occur if a dquot purge races with
drop_caches.

Reported-by: syzbot+912776840162c13db1a3@syzkaller.appspotmail.com
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
This commit is contained in:
Dave Chinner 2022-12-08 08:29:22 -08:00 committed by Darrick J. Wong
parent 1f5619ed88
commit 52f31ed228
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
fs/xfs/xfs_qm.c
View File

@ -422,6 +422,14 @@ xfs_qm_dquot_isolate(
if (!xfs_dqlock_nowait(dqp)) if (!xfs_dqlock_nowait(dqp))
goto out_miss_busy; goto out_miss_busy;
/*
* If something else is freeing this dquot and hasn't yet removed it
* from the LRU, leave it for the freeing task to complete the freeing
* process rather than risk it being free from under us here.
*/
if (dqp->q_flags & XFS_DQFLAG_FREEING)
goto out_miss_unlock;
/* /*
* This dquot has acquired a reference in the meantime remove it from * This dquot has acquired a reference in the meantime remove it from
* the freelist and try again. * the freelist and try again.
@ -441,10 +449,8 @@ xfs_qm_dquot_isolate(
* skip it so there is time for the IO to complete before we try to * skip it so there is time for the IO to complete before we try to
* reclaim it again on the next LRU pass. * reclaim it again on the next LRU pass.
*/ */
if (!xfs_dqflock_nowait(dqp)) { if (!xfs_dqflock_nowait(dqp))
xfs_dqunlock(dqp); goto out_miss_unlock;
goto out_miss_busy;
}
if (XFS_DQ_IS_DIRTY(dqp)) { if (XFS_DQ_IS_DIRTY(dqp)) {
struct xfs_buf *bp = NULL; struct xfs_buf *bp = NULL;
@ -478,6 +484,8 @@ xfs_qm_dquot_isolate(
XFS_STATS_INC(dqp->q_mount, xs_qm_dqreclaims); XFS_STATS_INC(dqp->q_mount, xs_qm_dqreclaims);
return LRU_REMOVED; return LRU_REMOVED;
out_miss_unlock:
xfs_dqunlock(dqp);
out_miss_busy: out_miss_busy:
trace_xfs_dqreclaim_busy(dqp); trace_xfs_dqreclaim_busy(dqp);
XFS_STATS_INC(dqp->q_mount, xs_qm_dqreclaim_misses); XFS_STATS_INC(dqp->q_mount, xs_qm_dqreclaim_misses);