Re: [PATCH] xfs: fix mount failure crash on invalid iclog memory access

["Darrick J. Wong" <darrick.wong@oracle.com>]

On Tue, Dec 03, 2019 at 09:05:24AM -0500, Brian Foster wrote:
> syzbot (via KASAN) reports a use-after-free in the error path of
> xlog_alloc_log(). Specifically, the iclog freeing loop doesn't
> handle the case of a fully initialized ->l_iclog linked list.
> Instead, it assumes that the list is partially constructed and NULL
> terminated.
> 
> This bug manifested because there was no possible error scenario
> after iclog list setup when the original code was added.  Subsequent
> code and associated error conditions were added some time later,
> while the original error handling code was never updated. Fix up the
> error loop to terminate either on a NULL iclog or reaching the end
> of the list.
> 
> Reported-by: syzbot+c732f8644185de340492@syzkaller.appspotmail.com
> Signed-off-by: Brian Foster <bfoster@redhat.com>

Ahh, a proper S-o-B!  Thank you,
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>

--D

> ---
>  fs/xfs/xfs_log.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
> index 6a147c63a8a6..f6006d94a581 100644
> --- a/fs/xfs/xfs_log.c
> +++ b/fs/xfs/xfs_log.c
> @@ -1542,6 +1542,8 @@ xlog_alloc_log(
>  		prev_iclog = iclog->ic_next;
>  		kmem_free(iclog->ic_data);
>  		kmem_free(iclog);
> +		if (prev_iclog == log->l_iclog)
> +			break;
>  	}
>  out_free_log:
>  	kmem_free(log);
> -- 
> 2.20.1
>