From nobody Sun Jun 14 14:31:07 2026 Received: from mail-dy1-f180.google.com (mail-dy1-f180.google.com [74.125.82.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7817B25DB1A for ; Thu, 16 Apr 2026 02:55:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776308111; cv=none; b=D9J2HwmFp6G450XU7qxBZyLcZJgQXAsHpnuo/iSJ/bON+txSwd7spvcvmCcvSG80H+pMFAvOXRf/RWyEBMaGxh/nK0D50ChnVNffd1T6kRre7H1+ndeOXLDzoKUSZAxwI4lCR/EaPZ7guJ9N+gTaGjFV0sXGPjhXdQGR53sj5K4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776308111; c=relaxed/simple; bh=6S7KMazqhoVy+obkuqbNC9p0hOG+SegOff4nzVs5fcY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=jmTw2S6+LNvr2od+UHzi39WV04EwtQQAwN3nRqy+zYh4nU/YpU31pQAbmemkN1Xb7X0hTjRnyUtjEEsomm+zNz8ddLYFqJcDNRkeVrWS2l2OyXYBZHk3pk6R+A/yHWLJlhZx/WsNVeZ1vnEucPMCFdLMWJGSbtJE0/BGxFIxDJY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kDwdXPvJ; arc=none smtp.client-ip=74.125.82.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kDwdXPvJ" Received: by mail-dy1-f180.google.com with SMTP id 5a478bee46e88-2bd801b40dbso291663eec.0 for ; Wed, 15 Apr 2026 19:55:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776308110; x=1776912910; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=QE/BJl1ZObFBbMpGLrFvgyiHLdE0hg+6Ibwj1dVcmZc=; b=kDwdXPvJIT9LoZ29ksYCg1r5N0yil7nW2QQcJTJKeeluX2pxxLqSHZWjChA11brgMu PVVc45o/rIpSOXj+ARu6ktKwmC4uXb0gNK59/G+mlR8Uv2Uc01EvgEbCVE6KI1iqKJhM LKfl54FcQAVzmYJi7Ndisg4tx+A557rK0Gyiqpu3Ts/NufmOsB9ztbptY9Gk1IEYxkfI Khqie0En/wEo0ce5tpKH5lHvTi6D6MMF1LYCp9YWxMcslLKt6A+eV0E/oGtU0akVm/rH C/pdrma+jbuOwMoS6m4o8Qg8qmXx0/2x/JQymJw9c3T7jc8PUsbtblh70vkKXMeVHYIJ zH6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776308110; x=1776912910; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=QE/BJl1ZObFBbMpGLrFvgyiHLdE0hg+6Ibwj1dVcmZc=; b=SznzZQUaakBqOLjaXlisiTS6189B7H8bVCY142TDyEqHPtSjZNDQWZF7d/XxEYs1Qb bojQpim0GHXw9MRkBNzoLoXx8nORKI6IcbM+CKQ7kPW+I6476wvhy0z7veZRlQ5HLnqP XoZcKCoKmtGcM0jRLwa7x9KGjyBrnzsGvMZSRrcLsPQG/xiWgUb4qWjtK33p+09XYMPK rNbMn8MEYL24FA065AbfYE1xMnk364zjXa3vJOjlKD+/YAazBCtb7SsT67RNbn5uMbvN B3sW+/9zr1sxDqc6FGPHONwMjiSmVnlUcRONgjWc91bWJUAU5fhN+pLhw3WgqO77lXVq Ar2w== X-Forwarded-Encrypted: i=1; AFNElJ8nO0LkQpqdoEO9barA1oSb6zAiF4Q+GOkW39Q0eR/dmCsmmCfZkrw0QVaAQjxouCbnwklwgKnGB31uJyM=@vger.kernel.org X-Gm-Message-State: AOJu0YxAvJjZ9O+lmVn+5BQrgnlv05gkgaRd9iflcU7IhmZUTBNW25cJ 6MZnOhiUCdzAOtK3yXdYBWHo4bf85XXvIe7B7Pi/izFwmOGskJfvKqT8f+pVnJwM X-Gm-Gg: AeBDiet7SIRC+MJQxlVhmxK08R8oJwyQ0qFpeK8BM1V/yhGou61N2JO8YIWwoaH3/GZ kbIFOK//xR+6egBIoBEXZs5yxBdxCw7HweLQOe/+JHqYxYlQUKMofCKvz10JDNMzLBdtVg4OLgc QIUocCf03HoMudU86zb0027c49uSK/cBDPM1JivX/EEuMydsezPLyk2fzGMNU6lp6PNwT4NWat6 skdMqaP/RZDuEkkG3EBBJTlVblTODDMRwV7z1W0/Z6zwH04VXVnifcQE+CmrotosGLzGUX4aGZ3 acgKqMD5WJy8/F6WM+NkBygfbCTS9PivMInYEd9kZWppGiYxGsG63+YNnj6y1Dm+Iz+tDE5N3FI G7gxCXofFC3Kc/+u4QWJnNaPQJhYndNBvN3ooih3y9O8smfcdRChDYBYHfG7yaAo88ktDeTHsum 3vzqZQR2K233Vp71l5OPC8ndaY2xo= X-Received: by 2002:a05:7300:134a:b0:2d9:94b4:a1bc with SMTP id 5a478bee46e88-2de7d021ec5mr1092602eec.8.1776308109369; Wed, 15 Apr 2026 19:55:09 -0700 (PDT) Received: from macbookair ([2600:8802:2a09:a700::4e5e]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2de8f65f9bcsm6577527eec.22.2026.04.15.19.55.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Apr 2026 19:55:08 -0700 (PDT) From: Tejas Bharambe X-Google-Original-From: Tejas Bharambe To: ocfs2-devel@lists.linux.dev Cc: mark@fasheh.com, jlbec@evilplan.org, joseph.qi@linux.alibaba.com, linux-kernel@vger.kernel.org, syzbot+a49010a0e8fcdeea075f@syzkaller.appspotmail.com, akpm@linux-foundation.org, stable@vger.kernel.org, Tejas Bharambe Subject: [PATCH v7] ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Date: Wed, 15 Apr 2026 19:55:01 -0700 Message-ID: <20260416025501.67593-1-tejas.bharambe@outlook.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Tejas Bharambe filemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY, as documented in mm/filemap.c: "If our return value has VM_FAULT_RETRY set, it's because the mmap_lock may be dropped before doing I/O or by lock_folio_maybe_drop_mmap()." When this happens, a concurrent munmap() can call remove_vma() and free the vm_area_struct via RCU. The saved 'vma' pointer in ocfs2_fault() then becomes a dangling pointer, and the subsequent trace_ocfs2_fault() call dereferences it -- a use-after-free. Fix this by saving ip_blkno as a plain integer before calling filemap_fault(), and removing vma from the trace event. Since ip_blkno is copied by value before the lock can be dropped, it remains valid regardless of what happens to the vma or inode afterward. Reported-by: syzbot+a49010a0e8fcdeea075f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Da49010a0e8fcdeea075f Fixes: 614a9e849ca6 ("ocfs2: Remove FILE_IO from masklog.") Cc: stable@vger.kernel.org Suggested-by: Joseph Qi Signed-off-by: Tejas Bharambe --- fs/ocfs2/mmap.c | 7 +++---- fs/ocfs2/ocfs2_trace.h | 10 ++++------ 2 files changed, 7 insertions(+), 10 deletions(-) diff --git a/fs/ocfs2/mmap.c b/fs/ocfs2/mmap.c index 50e2faf64c..6c570157ca 100644 --- a/fs/ocfs2/mmap.c +++ b/fs/ocfs2/mmap.c @@ -30,7 +30,8 @@ =20 static vm_fault_t ocfs2_fault(struct vm_fault *vmf) { - struct vm_area_struct *vma =3D vmf->vma; + unsigned long long ip_blkno =3D + OCFS2_I(file_inode(vmf->vma->vm_file))->ip_blkno; sigset_t oldset; vm_fault_t ret; =20 @@ -38,11 +39,9 @@ static vm_fault_t ocfs2_fault(struct vm_fault *vmf) ret =3D filemap_fault(vmf); ocfs2_unblock_signals(&oldset); =20 - trace_ocfs2_fault(OCFS2_I(vma->vm_file->f_mapping->host)->ip_blkno, - vma, vmf->page, vmf->pgoff); + trace_ocfs2_fault(ip_blkno, vmf->page, vmf->pgoff); return ret; } - static vm_fault_t __ocfs2_page_mkwrite(struct file *file, struct buffer_head *di_bh, struct folio *folio) { diff --git a/fs/ocfs2/ocfs2_trace.h b/fs/ocfs2/ocfs2_trace.h index 4b32fb5658..6c2c97a980 100644 --- a/fs/ocfs2/ocfs2_trace.h +++ b/fs/ocfs2/ocfs2_trace.h @@ -1246,22 +1246,20 @@ TRACE_EVENT(ocfs2_write_end_inline, =20 TRACE_EVENT(ocfs2_fault, TP_PROTO(unsigned long long ino, - void *area, void *page, unsigned long pgoff), - TP_ARGS(ino, area, page, pgoff), + void *page, unsigned long pgoff), + TP_ARGS(ino, page, pgoff), TP_STRUCT__entry( __field(unsigned long long, ino) - __field(void *, area) __field(void *, page) __field(unsigned long, pgoff) ), TP_fast_assign( __entry->ino =3D ino; - __entry->area =3D area; __entry->page =3D page; __entry->pgoff =3D pgoff; ), - TP_printk("%llu %p %p %lu", - __entry->ino, __entry->area, __entry->page, __entry->pgoff) + TP_printk("%llu %p %lu", + __entry->ino, __entry->page, __entry->pgoff) ); =20 /* End of trace events for fs/ocfs2/mmap.c. */ --=20 2.53.0