linux/fs
Jan Kara b0bca4e95b
fs: Fix possible UAF in mark_buffer_write_io_error()
When filesystem is freeing inode it calls mmb_invalidate() which removes
bhs from inode's metadata bh tracking and clears b_mmb for them. However
if the inode is getting deleted, we don't bother with calling mmb_sync()
before and thus these buffers can be under IO and we can be racing with
IO completion handler calling mark_buffer_write_io_error(). This race
can lead to mark_buffer_write_io_error() either hitting NULL pointer
reference or trying to operate on already freed inode. Protect the
mapping handling with RCU to make sure mmb and inode aren't freed before
we are done with them.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260727104923.3828017-22-jack@suse.cz
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-27 16:25:31 +02:00
..
9p Asides of the avalanche of LLM-driven fixes, there are a couple of 2026-06-21 10:26:31 -07:00
adfs ARM development for 7.1-rc1 2026-04-25 07:44:26 -07:00
affs affs: Drop support for metadata bh tracking 2026-07-27 16:25:31 +02:00
afs netfs: Replace wb_lock with a bit lock for asynchronicity 2026-07-01 15:26:29 +02:00
autofs vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
befs befs: handle set_blocksize failures 2026-05-21 13:39:35 +02:00
bfs bfs: replace get_zeroed_page() with kzalloc() 2026-05-28 13:58:14 +02:00
btrfs for-7.2-rc3-tag 2026-07-14 09:10:27 -07:00
cachefiles cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE 2026-07-01 15:26:28 +02:00
ceph This adds support for manual client session reset in CephFS, allowing 2026-06-26 16:15:53 -07:00
coda coda cleanups and fixes 2026-04-21 14:03:10 -07:00
configfs configfs work 2026-06-15 04:28:20 +05:30
cramfs cramfs: drop obsolete Future Development notes and update tools URL 2026-05-03 09:12:23 -06:00
crypto fscrypt: Replace mk_users keyring with simple list 2026-06-22 12:12:11 -07:00
debugfs debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() 2026-04-02 16:15:23 +02:00
devpts Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dlm dlm: init per node debugfs before add to node hash 2026-05-08 08:38:03 -05:00
ecryptfs The set of eCryptfs changes for the 7.2-rc1 merge window consists of: 2026-06-26 08:24:06 -07:00
efivarfs efivarfs: use QSTR() in efivarfs_alloc_dentry 2026-04-28 12:30:59 +02:00
efs fs: efs: remove unneeded debug prints 2026-06-11 11:42:21 -07:00
erofs erofs: hide "cache_strategy=" for plain filesystems 2026-07-13 16:41:42 +08:00
exfat iomap: consolidate bio submission 2026-07-01 15:26:47 +02:00
exportfs find_acceptable_alias(): skip NORCU aliases with zero refcount 2026-06-05 00:34:55 -04:00
ext2 ext2: fix ignored return value of generic_write_sync() 2026-06-02 10:56:16 +02:00
ext4 Various ext4 updates for 7.2-rc1: 2026-06-18 09:42:02 -07:00
f2fs f2fs: fix to round down start offset of fallocate for pin file 2026-06-22 19:55:27 +00:00
fat fat: stop reading directory entries past the end-of-directory marker 2026-07-01 15:26:25 +02:00
freevxfs freevxfs: don't BUG() on unknown typed-extent type 2026-07-01 15:26:26 +02:00
fuse fuse: call fuse_send_readpages explicitly from fuse_readahead 2026-07-01 15:26:47 +02:00
gfs2 gfs2 fixes 2026-06-26 15:13:06 -07:00
hfs hfs/hfsplus updates for v7.2 2026-06-16 12:27:23 +05:30
hfsplus hfs/hfsplus updates for v7.2 2026-06-16 12:27:23 +05:30
hostfs Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hpfs vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
hugetlbfs mm: use mapping_mapped to simplify the code 2026-06-21 11:37:38 -07:00
iomap iomap: submit read bio after each extent 2026-07-01 15:26:47 +02:00
isofs \n 2026-06-16 11:58:52 +05:30
jbd2 Various ext4 updates for 7.2-rc1: 2026-06-18 09:42:02 -07:00
jffs2 treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
jfs vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
kernfs Driver core changes for 7.2-rc1 2026-06-15 12:41:17 +05:30
lockd lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file() 2026-06-09 16:32:59 -04:00
minix minix: avoid overflow in bitmap block count calculation 2026-07-01 15:26:24 +02:00
netfs netfs: Fix barriering when walking subrequest list 2026-07-03 11:52:41 +02:00
nfs NFS: Charge unstable writes by request size, not folio size 2026-07-08 14:43:40 -04:00
nfs_common NFSD: Remove NFSERR_EAGAIN 2026-01-02 13:43:41 -05:00
nfsd nfsd-7.2 fixes: 2026-07-13 08:38:01 -07:00
nilfs2 nilfs2 updates for v7.2 2026-06-16 12:14:20 +05:30
nls fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() 2025-12-01 11:58:06 +02:00
notify \n 2026-06-16 11:56:43 +05:30
ntfs Description for this pull request: 2026-07-10 18:20:15 -07:00
ntfs3 iomap: consolidate bio submission 2026-07-01 15:26:47 +02:00
ocfs2 mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
omfs omfs: handle set_blocksize failures 2026-05-21 13:39:36 +02:00
openpromfs
orangefs orangefs: keep the readdir entry size 64-bit in fill_from_part() 2026-07-01 15:26:27 +02:00
overlayfs ovl: fix comment about locking order 2026-07-01 15:26:25 +02:00
proc 20 hotfixes. 17 are for MM. 12 are cc:stable and the remaining 8 2026-07-06 18:51:36 -07:00
pstore mm.git review status for linus..mm-stable 2026-04-15 12:59:16 -07:00
qnx4 qnx4: handle set_blocksize failures 2026-05-21 13:39:35 +02:00
qnx6 fs/qnx6: fix pointer arithmetic in directory iteration 2026-05-28 14:16:33 +02:00
quota quota: allocate dquot_hash with kmalloc() 2026-05-27 15:12:22 +02:00
ramfs folio_batch: rename pagevec.h to folio_batch.h 2026-04-05 13:53:07 -07:00
resctrl fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list 2026-07-06 19:05:49 -07:00
romfs mm.git review status for linus..mm-stable 2026-02-18 20:50:32 -08:00
smb eight ksmbd server fixes 2026-07-17 21:41:54 -07:00
squashfs Squashfs: check metadata block offset is within range 2026-02-24 11:13:27 -08:00
sysfs Driver core changes for 7.2-rc1 2026-06-15 12:41:17 +05:30
tests fs/tests: exec: Remove bad test vector 2026-03-18 11:41:53 -07:00
tracefs tracefs: use d_splice_alias() in ->lookup() instances 2026-06-05 01:12:15 -04:00
ubifs fs: add icount_read_once() and stop open-coding ->i_count loads 2026-05-11 23:12:28 +02:00
udf \n 2026-06-16 11:58:52 +05:30
ufs vfs-7.1-rc1.bh.metadata 2026-04-13 12:46:42 -07:00
unicode Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vboxsf vboxsf: Implement fileattr_get for case sensitivity 2026-05-11 16:50:29 +02:00
verity bpf-next-7.2 2026-06-17 09:18:14 +01:00
xfs xfs: fixes for v7.2-rc4 2026-07-16 09:40:03 -07:00
zonefs zonefs: handle integer overflow in zonefs_fname_to_fno 2026-05-12 07:53:20 +09:00
aio.c libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers 2026-06-04 10:10:49 +02:00
anon_inodes.c libfs: drop redundant SB_I_NOEXEC/SB_I_NODEV in init_pseudo() callers 2026-06-04 10:10:49 +02:00
attr.c filelock: add support for ignoring deleg breaks for dir change events 2026-05-15 19:24:32 +02:00
backing-file.c backing-file: fix backing_file_open() kerneldoc parameter 2026-06-10 09:49:25 +02:00
bad_inode.c fs: refactor ->update_time handling 2026-01-12 14:01:32 +01:00
binfmt_elf_fdpic.c vfs-7.1-rc1.kino 2026-04-13 12:19:01 -07:00
binfmt_elf.c mm: unexport vm_brk_flags() and eliminate vm_flags parameter 2026-04-05 13:53:39 -07:00
binfmt_flat.c
binfmt_misc.c binfmt_misc: replace __get_free_page() with kmalloc() 2026-05-28 13:58:14 +02:00
binfmt_script.c
bpf_fs_kfuncs.c bpf: have bpf_real_data_inode() take a struct file 2026-07-01 15:26:27 +02:00
buffer.c fs: Fix possible UAF in mark_buffer_write_io_error() 2026-07-27 16:25:31 +02:00
char_dev.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
compat_binfmt_elf.c
coredump.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
d_path.c dcache: permit dynamic_dname()s up to NAME_MAX 2026-04-07 12:32:22 +02:00
dax.c dax changes for 7.1 2026-04-21 14:12:01 -07:00
dcache.c dentry memory safety stuff 2026-06-15 04:15:31 +05:30
direct-io.c direct-io: remove IOCB_NOWAIT support 2026-05-26 11:01:55 -06:00
drop_caches.c
eventfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
eventpoll.c eventpoll: restore EP_UNACTIVE_PTR sentinel for ctx->tfile_check_list 2026-06-04 13:53:50 +02:00
exec.c exec: fix off-by-one in binfmt max rewrite depth comment 2026-07-01 15:26:27 +02:00
fcntl.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
fhandle.c fhandle: reject detached mounts in capable_wrt_mount() 2026-07-01 15:26:32 +02:00
file_attr.c fs: Add case sensitivity flags to file_kattr 2026-05-11 16:50:27 +02:00
file_table.c dentry memory safety stuff 2026-06-15 04:15:31 +05:30
file.c fs: retire stale comment in fget_task_next() 2026-05-28 14:27:00 +02:00
filesystems.c fs: fix ups and tidy ups to /proc/filesystems caching 2026-06-12 14:26:27 +02:00
fs_context.c vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
fs_dirent.c
fs_parser.c fs: remove fsparam_path / fs_param_is_path 2026-02-19 14:34:26 +01:00
fs_pin.c
fs_struct.c fs: add <linux/init_task.h> for 'init_fs' 2026-01-14 16:50:37 +01:00
fs-writeback.c mm: kick writeback flusher for IOCB_DONTCACHE with targeted dirty tracking 2026-06-04 10:16:51 +02:00
fserror.c treewide: change inode->i_ino from unsigned long to u64 2026-03-06 14:31:28 +01:00
fsopen.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
init.c struct filename series 2026-02-09 16:58:28 -08:00
inode.c mm.git review status for linus..mm-stable 2026-06-23 12:03:44 -07:00
internal.h fuse: invalidate page cache after DIO and async DIO writes 2026-06-15 14:06:20 +02:00
ioctl.c
Kconfig treewide: fix indentation and whitespace in Kconfig files 2026-05-28 21:24:42 -07:00
Kconfig.binfmt
kernel_read_file.c
libfs.c This series converts a bunch of unidiomatic uses of d_add() 2026-06-15 04:21:00 +05:30
locks.c filelock: add an inode_lease_ignore_mask helper 2026-05-15 19:24:32 +02:00
Makefile userfaultfd: merge fs/userfaultfd.c into mm/userfaultfd.c 2026-06-04 14:45:03 -07:00
mbcache.c vfs-7.1-rc1.misc 2026-04-13 14:20:11 -07:00
mnt_idmapping.c fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap 2026-05-11 14:19:01 +02:00
mount.h vfs-7.2-rc1.procfs 2026-06-15 04:07:58 +05:30
mpage.c mm.git review status for linus..mm-stable 2026-04-15 12:59:16 -07:00
namei.c fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid 2026-07-01 15:26:18 +02:00
namespace.c vfs-7.2-rc1.procfs 2026-06-15 04:07:58 +05:30
nsfs.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
nullfs.c fs: add immutable rootfs 2026-01-12 16:52:09 +01:00
open.c mm.git review status for linus..mm-stable 2026-06-23 12:03:44 -07:00
pidfs.c \n 2026-06-16 11:56:43 +05:30
pipe.c fs/pipe: pre-allocate pages outside pipe->mutex in anon_pipe_write 2026-05-28 14:33:24 +02:00
pnode.c
pnode.h
posix_acl.c filelock: add support for ignoring deleg breaks for dir change events 2026-05-15 19:24:32 +02:00
proc_namespace.c
read_write.c fs/read_write: Do not export __kernel_write() to the entire world 2026-06-05 14:46:20 +02:00
readdir.c fs: Replace user_access_{begin/end} by scoped user access 2026-03-24 14:44:02 +01:00
remap_range.c
select.c vfs-7.2-rc1.misc 2026-06-15 03:59:45 +05:30
seq_file.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
signalfd.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
splice.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
stack.c
stat.c statx: switch to CLASS(filename_maybe_null) 2026-01-16 12:52:04 -05:00
statfs.c user_statfs(): switch to CLASS(filename) 2026-01-16 12:52:04 -05:00
super.c dentry memory safety stuff 2026-06-15 04:15:31 +05:30
sync.c sync_file_range: delete dead S_ISLNK code 2026-05-21 13:39:36 +02:00
sysctls.c
timerfd.c fs/timerfd: Use the new alarm/hrtimer functions 2026-05-01 21:36:13 +02:00
utimes.c do_utimes_path(): switch to CLASS(filename_uflags) 2026-01-16 12:52:03 -05:00
xattr.c lsm/stable-7.2 PR 20260615 2026-06-17 12:34:16 +01:00