From: Jan Kara <jack@suse.cz>
To: Greg KH <greg@kroah.com>
Cc: Jan Kara <jack@suse.cz>, Ted Tso <tytso@mit.edu>,
linux-ext4@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH] jbd2: Fix use after free in jbd2_log_do_checkpoint()
Date: Thu, 4 Oct 2018 18:05:46 +0200 [thread overview]
Message-ID: <20181004160546.GH28384@quack2.suse.cz> (raw)
In-Reply-To: <20181004154402.GC6921@kroah.com>
On Thu 04-10-18 08:44:02, Greg KH wrote:
> On Thu, Oct 04, 2018 at 12:46:40PM +0200, Jan Kara wrote:
> > The code cleaning transaction's lists of checkpoint buffers has a bug
> > where it increases bh refcount only after releasing
> > journal->j_list_lock. Thus the following race is possible:
> >
> > CPU0 CPU1
> > jbd2_log_do_checkpoint()
> > jbd2_journal_try_to_free_buffers()
> > __journal_try_to_free_buffer(bh)
> > ...
> > while (transaction->t_checkpoint_io_list)
> > ...
> > if (buffer_locked(bh)) {
> >
> > <-- IO completes now, buffer gets unlocked -->
> >
> > spin_unlock(&journal->j_list_lock);
> > spin_lock(&journal->j_list_lock);
> > __jbd2_journal_remove_checkpoint(jh);
> > spin_unlock(&journal->j_list_lock);
> > try_to_free_buffers(page);
> > get_bh(bh) <-- accesses freed bh
> >
> > Fix the problem by grabbing bh reference before unlocking
> > journal->j_list_lock.
> >
> > Fixes: dc6e8d669cf5cb3ff84707c372c0a2a8a5e80845
> > Fixes: be1158cc615fd723552f0d9912087423c7cadda5
>
> Nit, this normally looks like:
>
> Fixes: dc6e8d669cf5 ("jbd2: don't call get_bh() before calling __jbd2_journal_remove_checkpoint()")
>
> And this is created by:
> git show -s --abbrev-commit --abbrev=12 --pretty=format:"%h (\"%s\")%n"
OK, ok, will do next time. The full git commit ID is faster to cut-n-paste
which shows how lazy I'm ;)
Honza
--
Jan Kara <jack@suse.com>
SUSE Labs, CR
next prev parent reply other threads:[~2018-10-04 22:59 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-04 10:46 [PATCH] jbd2: Fix use after free in jbd2_log_do_checkpoint() Jan Kara
2018-10-04 11:50 ` Lukas Czerner
2018-10-04 12:30 ` Jan Kara
2018-10-04 15:44 ` Greg KH
2018-10-04 16:05 ` Jan Kara [this message]
2018-10-04 16:33 ` Lukas Czerner
2018-10-04 21:22 ` Theodore Y. Ts'o
2018-10-05 9:18 ` Jan Kara
2018-10-05 22:57 ` Theodore Y. Ts'o
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181004160546.GH28384@quack2.suse.cz \
--to=jack@suse.cz \
--cc=greg@kroah.com \
--cc=linux-ext4@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).