From: sashiko-bot@kernel.org
To: "Christian Brauner" <brauner@kernel.org>
Cc: linux-ext4@vger.kernel.org, tytso@mit.edu,
linux-trace-kernel@vger.kernel.org
Subject: Re: [PATCH 7/8] ntfs3: free the sbi after a grace period
Date: Fri, 09 Oct 2026 22:03:48 +0000 [thread overview]
Message-ID: <sashiko-outbox-166121@kernel.org> (raw)
In-Reply-To: <20261009-work-fixes-rcu-v1-7-7446d2d335e6@kernel.org>
> If the "nocase" mount option ntfs3 uses custom hash and dentry compare
> functions. Both access ntfs3 superblock private information in rcu
> pathwalk. ntfs_put_super() and ntfs3_kill_sb() drop the info without any
> rcu delay. A lookup that's still inside the filesystem when the last
> reference to the mount is dropped causes a UAF. With a pathwalk held up
> in ntfs_d_hash() while the last reference to the mount goes away:
>
> BUG: KASAN: slab-use-after-free in ntfs_nls_to_utf16+0x752/0x940
> Read of size 8 at addr ff1100010453c850 by task walker/99
> Call Trace:
> <TASK>
> ntfs_nls_to_utf16+0x752/0x940
> ntfs_d_hash+0x22b/0x500
> link_path_walk+0x11ad/0x1d30
> path_lookupat+0x63/0xb00
> [ ... ]
> holding the lock on the same cpu.
>
> Fixes: a3a956c78efa ("fs/ntfs3: Add option "nocase"")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261009-work-fixes-rcu-v1-0-7446d2d335e6@kernel.org?part=7
next prev parent reply other threads:[~2026-10-09 22:03 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-09 21:51 [PATCH 0/8] fs: fix a range of UAFs during rcu pathwalk caused by non-rcu frees Christian Brauner
2026-10-09 21:51 ` [PATCH 1/8] ext4: free the sbi after a grace period Christian Brauner
2026-10-09 22:04 ` sashiko-bot
2026-10-13 12:14 ` Jan Kara
2026-10-09 21:51 ` [PATCH 2/8] afs: free the super info " Christian Brauner
2026-10-09 22:07 ` sashiko-bot
2026-10-10 12:54 ` Christian Brauner
2026-10-09 21:51 ` [PATCH 3/8] 9p: free the session " Christian Brauner
2026-10-09 22:03 ` sashiko-bot
2026-10-09 21:51 ` [PATCH 4/8] eventfs: free the eventfs_inode after an rcu grace period too Christian Brauner
2026-10-09 21:58 ` sashiko-bot
2026-10-09 21:51 ` [PATCH 5/8] ipc: drop the mqueue mount with kern_unmount() on setup failure Christian Brauner
2026-10-09 22:00 ` sashiko-bot
2026-10-09 21:51 ` [PATCH 6/8] unicode: free the map after a grace period Christian Brauner
2026-10-09 22:04 ` sashiko-bot
2026-10-13 12:16 ` Jan Kara
2026-10-13 17:35 ` Gabriel Krisman Bertazi
2026-10-09 21:51 ` [PATCH 7/8] ntfs3: free the sbi " Christian Brauner
2026-10-09 22:03 ` sashiko-bot [this message]
2026-10-09 21:51 ` [PATCH 8/8] ntfs3: free replaced mount options " Christian Brauner
2026-10-09 22:02 ` sashiko-bot
2026-10-10 12:55 ` Christian Brauner
2026-10-12 10:36 ` [PATCH 0/8] fs: fix a range of UAFs during rcu pathwalk caused by non-rcu frees Jan Kara
2026-10-12 10:42 ` Christian Brauner
2026-10-13 10:47 ` Jan Kara
2026-10-13 19:23 ` Christian Brauner
2026-10-13 19:25 ` Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-166121@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=brauner@kernel.org \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.