filelock: fix potential use-after-free in posix_lock_inode

BugLink: https://bugs.launchpad.net/bugs/2078289

[ Upstream commit 1b3ec4f7c03d4b07bad70697d7e2f4088d2cfe92 ]

Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode().
The request pointer had been changed earlier to point to a lock entry
that was added to the inode's list. However, before the tracepoint could
fire, another task raced in and freed that lock.

Fix this by moving the tracepoint inside the spinlock, which should
ensure that this doesn't happen.

Fixes: 74f6f59126 ("locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock")
Link: https://lore.kernel.org/linux-fsdevel/724ffb0a2962e912ea62bb0515deadf39c325112.camel@kernel.org/
Reported-by: Light Hsieh (謝明燈) <Light.Hsieh@mediatek.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://lore.kernel.org/r/20240702-filelock-6-10-v1-1-96e766aadc98@kernel.org
Reviewed-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Portia Stephens <portia.stephens@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

This commit is contained in:

Jeff Layton

2024-07-02 18:44:48 -04:00

committed by

Stefan Bader

parent 461e255dd3

commit 54891582fc

1 changed files with 1 additions and 1 deletions

									
										fs/locks.c
									
		+1
		-1
	
												View File
												
				@@ -1313,9 +1313,9 @@ retry:

						locks_wake_up_blocks(left);

					}

				 out:

					trace_posix_lock_inode(inode, request, error);

					spin_unlock(&ctx->flc_lock);

					percpu_up_read(&file_rwsem);

					trace_posix_lock_inode(inode, request, error);

					/*

					 * Free any unused locks.

					 */