diff options
| author | Ryusuke Konishi <konishi.ryusuke@gmail.com> | 2024-05-20 22:26:19 +0900 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2024-05-24 11:55:07 -0700 |
| commit | f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 (patch) | |
| tree | 7446db1845c4d4d35dd04fda7f0f60dd47d118cf /tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c | |
| parent | 1901472fa880e5706f90926cd85a268d2d16bf84 (diff) | |
nilfs2: fix use-after-free of timer for log writer thread
Patch series "nilfs2: fix log writer related issues".
This bug fix series covers three nilfs2 log writer-related issues,
including a timer use-after-free issue and potential deadlock issue on
unmount, and a potential freeze issue in event synchronization found
during their analysis. Details are described in each commit log.
This patch (of 3):
A use-after-free issue has been reported regarding the timer sc_timer on
the nilfs_sc_info structure.
The problem is that even though it is used to wake up a sleeping log
writer thread, sc_timer is not shut down until the nilfs_sc_info structure
is about to be freed, and is used regardless of the thread's lifetime.
Fix this issue by limiting the use of sc_timer only while the log writer
thread is alive.
Link: https://lkml.kernel.org/r/20240520132621.4054-1-konishi.ryusuke@gmail.com
Link: https://lkml.kernel.org/r/20240520132621.4054-2-konishi.ryusuke@gmail.com
Fixes: fdce895ea5dd ("nilfs2: change sc_timer from a pointer to an embedded one in struct nilfs_sc_info")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: "Bai, Shuangpeng" <sjb7183@psu.edu>
Closes: https://groups.google.com/g/syzkaller/c/MK_LYqtt8ko/m/8rgdWeseAwAJ
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c')
0 files changed, 0 insertions, 0 deletions