Skip to content

Commit 1b3ec4f

Browse files
jtlaytonbrauner
authored andcommitted
filelock: fix potential use-after-free in posix_lock_inode
Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a lock entry that was added to the inode's list. However, before the tracepoint could fire, another task raced in and freed that lock. Fix this by moving the tracepoint inside the spinlock, which should ensure that this doesn't happen. Fixes: 74f6f59 ("locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock") Link: https://lore.kernel.org/linux-fsdevel/724ffb0a2962e912ea62bb0515deadf39c325112.camel@kernel.org/ Reported-by: Light Hsieh (謝明燈) <Light.Hsieh@mediatek.com> Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://lore.kernel.org/r/20240702-filelock-6-10-v1-1-96e766aadc98@kernel.org Reviewed-by: Alexander Aring <aahringo@redhat.com> Signed-off-by: Christian Brauner <brauner@kernel.org>
1 parent eeb1798 commit 1b3ec4f

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

fs/locks.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1367,9 +1367,9 @@ static int posix_lock_inode(struct inode *inode, struct file_lock *request,
13671367
locks_wake_up_blocks(&left->c);
13681368
}
13691369
out:
1370+
trace_posix_lock_inode(inode, request, error);
13701371
spin_unlock(&ctx->flc_lock);
13711372
percpu_up_read(&file_rwsem);
1372-
trace_posix_lock_inode(inode, request, error);
13731373
/*
13741374
* Free any unused locks.
13751375
*/

0 commit comments

Comments
 (0)