github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

hfs/hfsplus: serialize B-tree close against folio release

Browse Source 
B-tree nodes with a zero reference count remain in the node hash until
folio reclaim or tree teardown frees them.  The folio release callbacks
remove nodes while holding hash_lock, but hfs_btree_close() walks and
frees the same hash without that lock.  Reclaim can therefore unhash and
free a node after close has loaded its pointer, causing a use-after-free
or double-free.

The following syzkaller crashes seem to be the same UAF in
{hfs,hfsplus}_btree_close() (or {hfs,hfsplus}_bnode_unhash()) and follow
the same pattern, but do not contain a reproducer to confirm.

Detach each node with hfs_bnode_unhash() while holding hash_lock before
inspecting and freeing it.  Drop the lock before hfs_bnode_free() so a
large tree is not freed while holding a spinlock.  Apply the same fix to
the matching HFS+ implementation.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+d729df28d933979e017a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d729df28d933979e017a
Reported-by: syzbot+2eac7d175baf21e6a5d5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2eac7d175baf21e6a5d5
Reported-by: syzbot+7155b2fe09e033c91381@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7155b2fe09e033c91381
Reported-by: syzbot+adeb387cede15eb11607@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=adeb387cede15eb11607
Reported-by: syzbot+ae7f2423f3648100506d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ae7f2423f3648100506d
Assisted-by: Codex:gpt-5.6-sol
Reported-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Tested-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260921153729.600313-1-bruno.produit@trailofbits.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
This commit is contained in:
Bruno Produit 2026-09-21 17:37:29 +02:00 committed by Viacheslav Dubeyko
parent 2166825899
commit dce0e02482
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
fs/hfs/btree.c
View File

@ -310,15 +310,18 @@ void hfs_btree_close(struct hfs_btree *tree)
return;
for (i = 0; i < NODE_HASH_SIZE; i++) {
spin_lock(&tree->hash_lock);
while ((node = tree->node_hash[i])) {
tree->node_hash[i] = node->next_hash;
hfs_bnode_unhash(node);
spin_unlock(&tree->hash_lock);
if (atomic_read(&node->refcnt))
pr_err("node %d:%d still has %d user(s)!\n",
node->tree->cnid, node->this,
atomic_read(&node->refcnt));
hfs_bnode_free(node);
tree->node_hash_cnt--;
spin_lock(&tree->hash_lock);
}
spin_unlock(&tree->hash_lock);
}
iput(tree->inode);
kfree(tree);

7
fs/hfsplus/btree.c
View File

@ -417,16 +417,19 @@ void hfs_btree_close(struct hfs_btree *tree)
return;
for (i = 0; i < NODE_HASH_SIZE; i++) {
spin_lock(&tree->hash_lock);
while ((node = tree->node_hash[i])) {
tree->node_hash[i] = node->next_hash;
hfs_bnode_unhash(node);
spin_unlock(&tree->hash_lock);
if (atomic_read(&node->refcnt))
pr_crit("node %d:%d "
"still has %d user(s)!\n",
node->tree->cnid, node->this,
atomic_read(&node->refcnt));
hfs_bnode_free(node);
tree->node_hash_cnt--;
spin_lock(&tree->hash_lock);
}
spin_unlock(&tree->hash_lock);
}
iput(tree->inode);
kfree(tree);