From nobody Fri Oct 2 10:08:01 2026 Received: from mail-qk1-f173.google.com (mail-qk1-f173.google.com [209.85.222.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B8DEF175A91 for ; Mon, 3 Aug 2026 01:08:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785719297; cv=none; b=uAZ3JsPhuKJ9WO9llaO/Iln0MVTkdnEw6zhWZOI8RIcp7Uds/HL7vPw3tIrdlqweA2XZEXVeu4Gbfav0AXr5utaMLHlwCmnr2F+CRtfMjtX4zlR/P/e7yZTkm153CHcbjWlKsMi6CQT2GfUXk0xwBQ74I6aej0BPl8PqqE4sOdY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785719297; c=relaxed/simple; bh=+AFzDGrbgbHQLozO+hvwKZjMsyx+HPtIIlmA32AFNUc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=p+FomxfJDhZwgApZ7rjv8JBYrEjshwesFPujgkC85N65vBWBGB7jK6er+cFiGYGEaE5PsgL3OV1wGcsW6yglLPMPhY154DHG2hbStXSZ9C2wgsiu3vM+Q4mNFeV5R/G5CyDccOZQUk7NMhKtWa4QX4C/Wij6gi0uNVhkFHZrdHE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JGchWIBb; arc=none smtp.client-ip=209.85.222.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JGchWIBb" Received: by mail-qk1-f173.google.com with SMTP id af79cd13be357-93108a3c326so217047085a.1 for ; Sun, 02 Aug 2026 18:08:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785719295; x=1786324095; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=lYgwypkukQzkIFuPlBn7zL4zFMnuhc4d9HofrAew4R4=; b=JGchWIBbr29MfVoRdiSaBa8bnjA78uptQZILcXzUcQZJjQ2+C8yA2MhzbDvYtUcC72 k+/a13EuD+Gndhowz6nYU+IRPBWk11OBFHz4Wss9P/anuQcTkbwaDKIiOUao9A612Fnx IwCVfS/yKrkEB0n35t2B6/cOnuHqRvZXAWHnIgA5RiAK4kXuFOgdOeH40ojovO/w9DNg iEK/zj6vUPg9bUMS4CKIDmK+KSq58C1PMkTyiT0CEE6+/mY6d6vYNnH3MSIwOP7mi/S2 ITk3+w7S+WL+Zzsz1Ge0NMySNbv5O19Z1zZnRWG+MpxU80p90LVEvDcmcpGgkwH7Dacs gyDA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785719295; x=1786324095; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=lYgwypkukQzkIFuPlBn7zL4zFMnuhc4d9HofrAew4R4=; b=LUAqGTpZOeup6/QuW+drmIetNk3aQBMh2GuKGFdRR137QJbeoT12QZ7njL1XmKr9CV zBD2bldAxFcGJCLRk6wRGRpc6oaqPFzTtM8/bmCYL9HBfl7dIykSWrdcNVWCnlvNbGuE ldRz8fb4zNGEjC5jQCh1MBfcAJa/kypQs9IBGJTJ7yEuCks7+v3JPyMBWWEnQ8mhLDa+ cBzW8fLGsF2Wfq1+q9ItdG/idyHlppcf/TgjO1kK4ULeoi17GpqEW/fq5SUyauZkELjt FTbIJRJYhDEm3FqHmvVFsCVYOCcDAlnUQXla9YBMFg0xYtJ57o6QmEdyebbGY0caZNM5 Q4nQ== X-Forwarded-Encrypted: i=1; AHgh+RrydUSTmRbzJRUJSCa4WrLqPFPE2zDlVVcLBViH8e+XWhjhBzlYkWsput51GBSjxjdv7NdKrref5gRGteQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yyey1gO2C8KrHgIiC4bv0n0aGfOFgPuDVf3zEk0WhaLTDUCrafy DLflrTQRwA6GP4zX8Zj6Bn4sN3WdbkTJNrkRZlA4tUXFvgc7Je00NURU X-Gm-Gg: AR+sD12cCcoinODsxD2/d5JcyLdE2zryK+RYWlc0lRCJvY0DmkZS65Tnp31aElYq4Fo dNTrXtWhCVWl70R8K040DSt30EyJ0OXr58RtGalNP0z1YGSXdk7ske5XHZbCAYd9wRxxe8JFSRL bHnO495+Q7vtfQLr+2hYUYwoE3LYQRqopNPW4vL2Uq0eb2VjGbq43UCD1xjpSHHaZBntM2Tkbg/ QBCE1tZF3ibeNA23tXdJiXdjQf3nG57RaQBypvJBImcSPwoL5XwpAcmWPeyOnNppYbYmF25BOGt AngAUK4RM2hi26K8BcRgiEo25/j57sGBY+1YjF49fdbTN7dIsZ5QEhnFh2w521H2d5iWwhk6cLn 0wDwSuzmcMq0HmniGctPUzQRVUx3Qa+jl497mUQ0hrslpra9KOd/hJ5kOKM3/qRln/saSdvZCO6 URO480WWxhOkQta8QTNPGrZqUnQaTgiATa1v3JFRhwT+oTF82Md62wJQGNU/jUy1nzNz81a8H9f SI9U5JveSZSxXboh1SO5Y52BmYT0+AlnRT9l6eV/d8= X-Received: by 2002:a05:620a:2590:b0:92e:fed1:beba with SMTP id af79cd13be357-934a0fed2b1mr1245344985a.3.1785719294578; Sun, 02 Aug 2026 18:08:14 -0700 (PDT) Received: from LAPTOP-DPAKMOI4.it.purdue.edu (pal-210-106-74.itap.purdue.edu. [128.210.106.74]) by smtp.gmail.com with ESMTPSA id af79cd13be357-9349c1e0e57sm552635385a.43.2026.08.02.18.08.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 02 Aug 2026 18:08:14 -0700 (PDT) From: Yifei Gao To: Mike Marshall Cc: Martin Brandenburg , devel@lists.orangefs.org, linux-kernel@vger.kernel.org, Yifei Gao , stable@vger.kernel.org Subject: [PATCH] orangefs: fix double-free of trailer_buf on readdir copy failure Date: Mon, 3 Aug 2026 01:07:55 +0000 Message-ID: <20260803010802.2415942-1-gyf161023@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails, but does not clear the pointer before goto Efault. The waiter in do_readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer_size exceeds the bytes it supplies. Clear the pointer after freeing so the readdir-side vfree() becomes a no-op. Fixes: 382f4581e67f ("orangefs: rewrite readdir to fix several bugs") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Yifei Gao --- fs/orangefs/devorangefs-req.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/orangefs/devorangefs-req.c b/fs/orangefs/devorangefs-req.c index 33ee8cb32f83..e5c60da7e677 100644 --- a/fs/orangefs/devorangefs-req.c +++ b/fs/orangefs/devorangefs-req.c @@ -474,6 +474,7 @@ static ssize_t orangefs_devreq_write_iter(struct kiocb = *iocb, op->downcall.trailer_size, iter)) { gossip_err("%s: failed to copy trailer.\n", __func__); vfree(op->downcall.trailer_buf); + op->downcall.trailer_buf =3D NULL; goto Efault; } =20 --=20 2.43.0