From nobody Sat Apr 11 05:15:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AF6DFC00140 for ; Mon, 15 Aug 2022 17:51:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231330AbiHORv0 (ORCPT ); Mon, 15 Aug 2022 13:51:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229785AbiHORvW (ORCPT ); Mon, 15 Aug 2022 13:51:22 -0400 Received: from mail-pl1-x631.google.com (mail-pl1-x631.google.com [IPv6:2607:f8b0:4864:20::631]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0BE71D137; Mon, 15 Aug 2022 10:51:21 -0700 (PDT) Received: by mail-pl1-x631.google.com with SMTP id 17so6958306plj.10; Mon, 15 Aug 2022 10:51:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc; bh=yFM5NAH4FbqVZAUN+RpSLe1Fb5MJe458XF5fgVWxzb8=; b=CK0iyepL58aRSd9LzU3quaQk58TnfOXRzthLNyTjGfWMiRTJsrmdiF/ja9RaaNW2c7 +fHU/9iCI9PjCnXTg49kGl/pME6keQJQVdyeA1Q/TAR30FKQYG7X4gWMyXdlUKQE+T5x gi6wRafz2djcfvrN/EgRyKfGR06izb63WYF/zQa1pSgccwk9SttjFfIC7Y7uvne6ytQj BedEFLdHTBW+qMFCmXwtM53T6JqvB0nkw/iCOf5vgRRaZ6SgXdh63pIWmq/cBvj+7X6f jkKx7Qd02UV422TUXwxuJeFA4edIw4BqNEbUHPSGU5tfExwX8XRDDauCo7t5KsYuEPGU IeCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc; bh=yFM5NAH4FbqVZAUN+RpSLe1Fb5MJe458XF5fgVWxzb8=; b=2CO5Kx+M2JzG9aDv2Ad3MJRgX808JXGI6gavrCvpokhl/w7CbIFABDmRucJG+s6g/t tWFsxqXS2vfaC/MmKR/gx5XZiMDd0LZ737KRa6dLoFKtD0Dm8hI2DbVpLSj+EbTw72H1 omCBg4m2b2dhS1ZvzU1MYUf8YURC18q2nQ/sDRp12/JxKE/Sh2xAnzIhN9NqZ31G847d 5xi8/nTfm8wYOpZ51t2F9/jIaQfJ0cy/Qh2lGAuOYWFooDP0bF3Ge1w7yhZr5xL81jhQ gxRuty1HoJliv2GRW0rKr/PULjndKgpZhyyGrbHmMDDZdjrl8p8nwHsNJHlkHrr2D4Al kSEw== X-Gm-Message-State: ACgBeo1urG5m6kWstVjzoV4qv0JEN8s4wuib0LvzdDhSQsl4Ia4n7OvX WV+6nWMqerN10tnLxJehF7o= X-Google-Smtp-Source: AA6agR7zPE2a0Hljj/eaQbuo1x5tVTpRF8Pxvb0Jz+Uz7gjjbwLldkebWpZ1+R22rpvpXNAIYkJFPw== X-Received: by 2002:a17:902:dac2:b0:172:5f2a:f30 with SMTP id q2-20020a170902dac200b001725f2a0f30mr10831822plx.167.1660585880460; Mon, 15 Aug 2022 10:51:20 -0700 (PDT) Received: from carrot.. (i114-190-253-100.s42.a014.ap.plala.or.jp. [114.190.253.100]) by smtp.gmail.com with ESMTPSA id i8-20020a1709026ac800b0016c5306917fsm7259729plt.53.2022.08.15.10.51.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 Aug 2022 10:51:18 -0700 (PDT) From: Ryusuke Konishi To: Andrew Morton Cc: Al Viro , linux-nilfs , LKML , Jiacheng Xu , Mudong Liang Subject: [PATCH] nilfs2: fix use-after-free bug in nilfs_mdt_destroy() Date: Tue, 16 Aug 2022 02:51:14 +0900 Message-Id: <20220815175114.23576-1-konishi.ryusuke@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" In alloc_inode(), inode_init_always() could return -ENOMEM if security_inode_alloc() fails. If this happens for nilfs2, nilfs_free_inode() is called without initializing inode->i_private and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees uninitialized inode->i_private and can trigger a crash. Fix this bug by initializing inode->i_private in nilfs_alloc_inode(). Link: https://lkml.kernel.org/r/CAFcO6XOcf1Jj2SeGt=3DjJV59wmhESeSKpfR0omdFR= q+J9nD1vfQ@mail.gmail.com Link: https://lkml.kernel.org/r/20211011030956.2459172-1-mudongliangabcd@gm= ail.com Reported-by: butt3rflyh4ck Reported-by: Hao Sun Reported-by: Jiacheng Xu Reported-by: Mudong Liang Signed-off-by: Ryusuke Konishi Cc: Al Viro --- fs/nilfs2/super.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c index ba108f915391..aca5614f1b44 100644 --- a/fs/nilfs2/super.c +++ b/fs/nilfs2/super.c @@ -159,6 +159,7 @@ struct inode *nilfs_alloc_inode(struct super_block *sb) ii->i_cno =3D 0; ii->i_assoc_inode =3D NULL; ii->i_bmap =3D &ii->i_bmap_data; + ii->vfs_inode.i_private =3D NULL; return &ii->vfs_inode; } =20 --=20 2.34.1