All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
	syzbot <syzbot+d0cf0ad6513e9a1da5df@syzkaller.appspotmail.com>,
	Kees Cook <keescook@chromium.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 5.10 1/8] pstore: Fix warning in pstore_kill_sb()
Date: Sun,  7 Mar 2021 08:57:54 -0500	[thread overview]
Message-ID: <20210307135801.967583-1-sashal@kernel.org> (raw)

From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

[ Upstream commit 9c7d83ae6ba67d6c6199cce24573983db3b56332 ]

syzbot is hitting WARN_ON(pstore_sb != sb) at pstore_kill_sb() [1], for the
assumption that pstore_sb != NULL is wrong because pstore_fill_super() will
not assign pstore_sb = sb when new_inode() for d_make_root() returned NULL
(due to memory allocation fault injection).

Since mount_single() calls pstore_kill_sb() when pstore_fill_super()
failed, pstore_kill_sb() needs to be aware of such failure path.

[1] https://syzkaller.appspot.com/bug?id=6abacb8da5137cb47a416f2bef95719ed60508a0

Reported-by: syzbot <syzbot+d0cf0ad6513e9a1da5df@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210214031307.57903-1-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/pstore/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c
index c331efe8de95..bbf241a431f2 100644
--- a/fs/pstore/inode.c
+++ b/fs/pstore/inode.c
@@ -467,7 +467,7 @@ static struct dentry *pstore_mount(struct file_system_type *fs_type,
 static void pstore_kill_sb(struct super_block *sb)
 {
 	mutex_lock(&pstore_sb_lock);
-	WARN_ON(pstore_sb != sb);
+	WARN_ON(pstore_sb && pstore_sb != sb);
 
 	kill_litter_super(sb);
 	pstore_sb = NULL;
-- 
2.30.1


             reply	other threads:[~2021-03-07 13:58 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-07 13:57 Sasha Levin [this message]
2021-03-07 13:57 ` [PATCH AUTOSEL 5.10 2/8] pstore/ram: Rate-limit "uncorrectable error in header" message Sasha Levin
2021-03-07 13:57 ` [PATCH AUTOSEL 5.10 3/8] drm/amdgpu: enable BACO runpm by default on sienna cichlid and navy flounder Sasha Levin
2021-03-07 13:57   ` Sasha Levin
2021-03-07 13:57   ` Sasha Levin
2021-03-07 13:57 ` [PATCH AUTOSEL 5.10 4/8] tracing: Skip selftests if tracing is disabled Sasha Levin
2021-03-07 13:57 ` [PATCH AUTOSEL 5.10 5/8] nvme-pci: mark Seagate Nytro XM1440 as QUIRK_NO_NS_DESC_LIST Sasha Levin
2021-03-07 13:57   ` Sasha Levin
2021-03-07 13:57 ` [PATCH AUTOSEL 5.10 6/8] nvme-pci: add quirks for Lexar 256GB SSD Sasha Levin
2021-03-07 13:57   ` Sasha Levin
2021-03-07 13:58 ` [PATCH AUTOSEL 5.10 7/8] nvme-fabrics: fix kato initialization Sasha Levin
2021-03-07 13:58   ` Sasha Levin
2021-03-07 13:58 ` [PATCH AUTOSEL 5.10 8/8] nvmet: model_number must be immutable once set Sasha Levin
2021-03-07 13:58   ` Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210307135801.967583-1-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=penguin-kernel@I-love.SAKURA.ne.jp \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+d0cf0ad6513e9a1da5df@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.