diff options
| author | Ryusuke Konishi <[email protected]> | 2024-05-20 22:26:19 +0900 |
|---|---|---|
| committer | Andrew Morton <[email protected]> | 2024-05-24 11:55:07 -0700 |
| commit | f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 (patch) | |
| tree | 7446db1845c4d4d35dd04fda7f0f60dd47d118cf /lib/test_fortify/write_overflow-strncpy-src.c | |
| parent | 1901472fa880e5706f90926cd85a268d2d16bf84 (diff) | |
nilfs2: fix use-after-free of timer for log writer thread
Patch series "nilfs2: fix log writer related issues".
This bug fix series covers three nilfs2 log writer-related issues,
including a timer use-after-free issue and potential deadlock issue on
unmount, and a potential freeze issue in event synchronization found
during their analysis. Details are described in each commit log.
This patch (of 3):
A use-after-free issue has been reported regarding the timer sc_timer on
the nilfs_sc_info structure.
The problem is that even though it is used to wake up a sleeping log
writer thread, sc_timer is not shut down until the nilfs_sc_info structure
is about to be freed, and is used regardless of the thread's lifetime.
Fix this issue by limiting the use of sc_timer only while the log writer
thread is alive.
Link: https://lkml.kernel.org/r/[email protected]
Link: https://lkml.kernel.org/r/[email protected]
Fixes: fdce895ea5dd ("nilfs2: change sc_timer from a pointer to an embedded one in struct nilfs_sc_info")
Signed-off-by: Ryusuke Konishi <[email protected]>
Reported-by: "Bai, Shuangpeng" <[email protected]>
Closes: https://groups.google.com/g/syzkaller/c/MK_LYqtt8ko/m/8rgdWeseAwAJ
Tested-by: Ryusuke Konishi <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Diffstat (limited to 'lib/test_fortify/write_overflow-strncpy-src.c')
0 files changed, 0 insertions, 0 deletions