Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-23 19:31:53 +00:00
Code Issues Packages Projects Releases Wiki Activity
c791730f25
linux/fs/udf
History
Shigeru Yoshida c791730f25 udf: Avoid double brelse() in udf_rename() 
syzbot reported a warning like below [1]:

VFS: brelse: Trying to free free buffer
WARNING: CPU: 2 PID: 7301 at fs/buffer.c:1145 __brelse+0x67/0xa0
...
Call Trace:
 <TASK>
 invalidate_bh_lru+0x99/0x150
 smp_call_function_many_cond+0xe2a/0x10c0
 ? generic_remap_file_range_prep+0x50/0x50
 ? __brelse+0xa0/0xa0
 ? __mutex_lock+0x21c/0x12d0
 ? smp_call_on_cpu+0x250/0x250
 ? rcu_read_lock_sched_held+0xb/0x60
 ? lock_release+0x587/0x810
 ? __brelse+0xa0/0xa0
 ? generic_remap_file_range_prep+0x50/0x50
 on_each_cpu_cond_mask+0x3c/0x80
 blkdev_flush_mapping+0x13a/0x2f0
 blkdev_put_whole+0xd3/0xf0
 blkdev_put+0x222/0x760
 deactivate_locked_super+0x96/0x160
 deactivate_super+0xda/0x100
 cleanup_mnt+0x222/0x3d0
 task_work_run+0x149/0x240
 ? task_work_cancel+0x30/0x30
 do_exit+0xb29/0x2a40
 ? reacquire_held_locks+0x4a0/0x4a0
 ? do_raw_spin_lock+0x12a/0x2b0
 ? mm_update_next_owner+0x7c0/0x7c0
 ? rwlock_bug.part.0+0x90/0x90
 ? zap_other_threads+0x234/0x2d0
 do_group_exit+0xd0/0x2a0
 __x64_sys_exit_group+0x3a/0x50
 do_syscall_64+0x34/0xb0
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The cause of the issue is that brelse() is called on both ofibh.sbh
and ofibh.ebh by udf_find_entry() when it returns NULL.  However,
brelse() is called by udf_rename(), too.  So, b_count on buffer_head
becomes unbalanced.

This patch fixes the issue by not calling brelse() by udf_rename()
when udf_find_entry() returns NULL.

Link: https://syzkaller.appspot.com/bug?id=8297f45698159c6bca8a1f87dc983667c1a1c851 [1]
Reported-by: syzbot+7902cd7684bc35306224@syzkaller.appspotmail.com
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20221023095741.271430-1-syoshida@redhat.com
2022-10-24 17:35:04 +02:00
..
balloc.c treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
dir.c udf: replace ll_rw_block() 2022-09-11 20:26:07 -07:00
directory.c udf: replace ll_rw_block() 2022-09-11 20:26:07 -07:00
ecma_167.h udf: Get rid of 0-length arrays in struct fileIdentDesc 2021-08-11 16:54:44 +02:00
file.c udf: Support splicing to file 2022-09-12 13:03:20 +02:00
ialloc.c udf: Fix error handling in udf_new_inode() 2021-12-15 13:08:34 +01:00
inode.c udf: replace ll_rw_block() 2022-09-11 20:26:07 -07:00
Kconfig docs: filesystems: fix renamed references 2020-04-20 15:45:22 -06:00
lowlevel.c udf: use sb_bdev_nr_blocks 2021-10-18 14:43:23 -06:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
misc.c udf_get_extendedattr() had no boundary checks. 2021-08-23 13:35:19 +02:00
namei.c udf: Avoid double brelse() in udf_rename() 2022-10-24 17:35:04 +02:00
osta_udf.h udf: Get rid of 0-length arrays 2021-08-11 16:54:44 +02:00
partition.c udf: Remove pointless union in udf_inode_info 2020-09-29 17:21:54 +02:00
super.c fs: udf: Optimize udf_free_in_core_inode and udf_find_fileset function 2022-10-24 16:49:00 +02:00
symlink.c udf: Convert adinicb and symlinks to read_folio 2022-05-09 16:21:46 -04:00
truncate.c udf: Fix spelling in EXT_NEXT_EXTENT_ALLOCDESCS 2020-01-08 11:11:46 +01:00
udf_i.h udf: Remove pointless union in udf_inode_info 2020-09-29 17:21:54 +02:00
udf_sb.h udf: Fix iocharset=utf8 mount option 2021-08-12 16:07:09 +02:00
udfdecl.h udf: Get rid of 0-length arrays in struct fileIdentDesc 2021-08-11 16:54:44 +02:00
udfend.h
udftime.c udf: convert inode stamps to timespec64 2018-06-27 13:58:00 +02:00
unicode.c udf: Fix iocharset=utf8 mount option 2021-08-12 16:07:09 +02:00