From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pdx-out-008.esa.us-west-2.outbound.mail-perimeter.amazon.com (pdx-out-008.esa.us-west-2.outbound.mail-perimeter.amazon.com [52.42.203.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CBB9B2DC32A for ; Tue, 31 Mar 2026 07:00:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=52.42.203.116 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774940451; cv=none; b=F4Pi2HOuWj9QtZxKOz5jCA+HEpbY2OGNB+4XPpIId2C825vpBw5d+hoeUG1WhJE1YZJTZj/xa+zW6Btf8bcPdUvw+pQj6/wT5wv4G9QVQTVlYvxGB+eQfqhJ8BEbHunK3DbGjAcgM+YGtCW5z4It+zF+6YNvWhJUH2Xt6rPHf2Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774940451; c=relaxed/simple; bh=CQnTfAotn0CwXzYne2gpYmldCyQ1irHmVHQXAOHoRqc=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=n5scuvpOEUuXQGJbyJn7op+XOmdpX8XTHBK45M43Vq7yUVAmVEOieeXQdcO3QFSrKCo0YOcScu7WplQQhOUCFnWbEuyUwciptdMShO0o0S9KmTYeEzF3/2CpdRpiFwIA3YQiSUwywrWEQVf+KSZLakARy2y9MnncnCEEUhRW6UA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com; spf=pass smtp.mailfrom=amazon.com; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b=gj7WUrOt; arc=none smtp.client-ip=52.42.203.116 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amazon.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b="gj7WUrOt" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazoncorp2; t=1774940449; x=1806476449; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=knC+iIeIQ4EnUAXjeSSd18oOPTf/Amwk9ojeWmxCVyE=; b=gj7WUrOtEU2mGirhKoZE1x60+PF8QbjU3y6kq2386pU6Z4fkVx/eFK/u XEfMy3r8PRecn+kV8hCmypMFLrel2ploDs3Wy0T8SHu87IWGFkHYPUi1Y mY+18ZrDTRgOxYpmNDt+zdXcwXK69M98xSOSg5epcGtUAz5KoxhCAxQ/V 00QUCVGmdge1IF7eJcRzJLI9J4r6b4oceyL8i60UfCfX0vMpGpfFCajyI V5o7VMroORLMIGt50GUzSn2Wj98bwFUlE/L2q/NLLFua9/BeE2UHq96fz TtgC9lCs5S7YQOUCTFBnwR6kcGJLzPuG3H/8aCUkYlX1+7JbbJd/loyFs g==; X-CSE-ConnectionGUID: cAzJtl3vQfSfDtNUkKFrZQ== X-CSE-MsgGUID: PmLr5BJpT6K5/c1zTbhgMw== X-IronPort-AV: E=Sophos;i="6.23,151,1770595200"; d="scan'208";a="16198382" Received: from ip-10-5-0-115.us-west-2.compute.internal (HELO smtpout.naws.us-west-2.prod.farcaster.email.amazon.dev) ([10.5.0.115]) by internal-pdx-out-008.esa.us-west-2.outbound.mail-perimeter.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 31 Mar 2026 07:00:47 +0000 Received: from EX19MTAUWB001.ant.amazon.com [205.251.233.51:18203] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.43.164:2525] with esmtp (Farcaster) id b87304fa-9580-4cb1-b0f0-04ae5a044c93; Tue, 31 Mar 2026 07:00:46 +0000 (UTC) X-Farcaster-Flow-ID: b87304fa-9580-4cb1-b0f0-04ae5a044c93 Received: from EX19D001UWA001.ant.amazon.com (10.13.138.214) by EX19MTAUWB001.ant.amazon.com (10.250.64.248) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.37; Tue, 31 Mar 2026 07:00:46 +0000 Received: from c889f3b07a0a.amazon.com (10.106.82.29) by EX19D001UWA001.ant.amazon.com (10.13.138.214) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.37; Tue, 31 Mar 2026 07:00:44 +0000 From: Yuto Ohnuki To: CC: , , , , Yuto Ohnuki , Subject: [PATCH 6.6.y 2/2] xfs: save ailp before dropping the AIL lock in push callbacks Date: Tue, 31 Mar 2026 08:00:36 +0100 Message-ID: <20260331070035.60480-2-ytohnuki@amazon.com> X-Mailer: git-send-email 2.50.0 In-Reply-To: <2026033009-pelt-display-3ac7@gregkh> References: <2026033009-pelt-display-3ac7@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: EX19D037UWC003.ant.amazon.com (10.13.139.231) To EX19D001UWA001.ant.amazon.com (10.13.138.214) Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is dropped to perform buffer IO. Once the cluster buffer no longer protects the log item from reclaim, the log item may be freed by background reclaim or the dquot shrinker. The subsequent spin_lock() call dereferences lip->li_ailp, which is a use-after-free. Fix this by saving the ailp pointer in a local variable while the AIL lock is held and the log item is guaranteed to be valid. Reported-by: syzbot+652af2b3c5569c4ab63c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=652af2b3c5569c4ab63c Fixes: 90c60e164012 ("xfs: xfs_iflush() is no longer necessary") Cc: stable@vger.kernel.org # v5.9 Reviewed-by: Darrick J. Wong Reviewed-by: Dave Chinner Signed-off-by: Yuto Ohnuki Signed-off-by: Carlos Maiolino (cherry picked from commit 394d70b86fae9fe865e7e6d9540b7696f73aa9b6) --- fs/xfs/xfs_dquot_item.c | 9 +++++++-- fs/xfs/xfs_inode_item.c | 9 +++++++-- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/fs/xfs/xfs_dquot_item.c b/fs/xfs/xfs_dquot_item.c index 7d19091215b0..74449aec81ed 100644 --- a/fs/xfs/xfs_dquot_item.c +++ b/fs/xfs/xfs_dquot_item.c @@ -125,6 +125,7 @@ xfs_qm_dquot_logitem_push( { struct xfs_dquot *dqp = DQUOT_ITEM(lip)->qli_dquot; struct xfs_buf *bp = lip->li_buf; + struct xfs_ail *ailp = lip->li_ailp; uint rval = XFS_ITEM_SUCCESS; int error; @@ -153,7 +154,7 @@ xfs_qm_dquot_logitem_push( goto out_unlock; } - spin_unlock(&lip->li_ailp->ail_lock); + spin_unlock(&ailp->ail_lock); error = xfs_qm_dqflush(dqp, &bp); if (!error) { @@ -163,7 +164,11 @@ xfs_qm_dquot_logitem_push( } else if (error == -EAGAIN) rval = XFS_ITEM_LOCKED; - spin_lock(&lip->li_ailp->ail_lock); + /* + * The buffer no longer protects the log item from reclaim, so + * do not reference lip after this point. + */ + spin_lock(&ailp->ail_lock); out_unlock: xfs_dqunlock(dqp); return rval; diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c index b55ad3b7b113..77cd2f168a2b 100644 --- a/fs/xfs/xfs_inode_item.c +++ b/fs/xfs/xfs_inode_item.c @@ -727,6 +727,7 @@ xfs_inode_item_push( struct xfs_inode_log_item *iip = INODE_ITEM(lip); struct xfs_inode *ip = iip->ili_inode; struct xfs_buf *bp = lip->li_buf; + struct xfs_ail *ailp = lip->li_ailp; uint rval = XFS_ITEM_SUCCESS; int error; @@ -749,7 +750,7 @@ xfs_inode_item_push( if (!xfs_buf_trylock(bp)) return XFS_ITEM_LOCKED; - spin_unlock(&lip->li_ailp->ail_lock); + spin_unlock(&ailp->ail_lock); /* * We need to hold a reference for flushing the cluster buffer as it may @@ -773,7 +774,11 @@ xfs_inode_item_push( rval = XFS_ITEM_LOCKED; } - spin_lock(&lip->li_ailp->ail_lock); + /* + * The buffer no longer protects the log item from reclaim, so + * do not reference lip after this point. + */ + spin_lock(&ailp->ail_lock); return rval; } -- 2.50.1 Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, R.C.S. Luxembourg B186284 Amazon Web Services EMEA SARL, Irish Branch, One Burlington Plaza, Burlington Road, Dublin 4, Ireland, branch registration number 908705