From: Greg Kroah-Hartman Date: Tue, 8 Jul 2025 18:16:24 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v5.15.187~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a80283ba5d483d9e7fc43fbfa125fc8d89d68e7a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: f2fs-fix-to-avoid-use-after-free-issue-in-f2fs_filemap_fault.patch --- diff --git a/queue-6.6/f2fs-fix-to-avoid-use-after-free-issue-in-f2fs_filemap_fault.patch b/queue-6.6/f2fs-fix-to-avoid-use-after-free-issue-in-f2fs_filemap_fault.patch new file mode 100644 index 0000000000..1bb8a515e4 --- /dev/null +++ b/queue-6.6/f2fs-fix-to-avoid-use-after-free-issue-in-f2fs_filemap_fault.patch @@ -0,0 +1,72 @@ +From eb70d5a6c932d9d23f4bb3e7b83782c21ac4b064 Mon Sep 17 00:00:00 2001 +From: Chao Yu +Date: Thu, 14 Mar 2024 10:05:28 +0800 +Subject: f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault + +From: Chao Yu + +commit eb70d5a6c932d9d23f4bb3e7b83782c21ac4b064 upstream. + +syzbot reports a f2fs bug as below: + +BUG: KASAN: slab-use-after-free in f2fs_filemap_fault+0xd1/0x2c0 fs/f2fs/file.c:49 +Read of size 8 at addr ffff88807bb22680 by task syz-executor184/5058 + +CPU: 0 PID: 5058 Comm: syz-executor184 Not tainted 6.7.0-syzkaller-09928-g052d534373b7 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 + print_address_description mm/kasan/report.c:377 [inline] + print_report+0x163/0x540 mm/kasan/report.c:488 + kasan_report+0x142/0x170 mm/kasan/report.c:601 + f2fs_filemap_fault+0xd1/0x2c0 fs/f2fs/file.c:49 + __do_fault+0x131/0x450 mm/memory.c:4376 + do_shared_fault mm/memory.c:4798 [inline] + do_fault mm/memory.c:4872 [inline] + do_pte_missing mm/memory.c:3745 [inline] + handle_pte_fault mm/memory.c:5144 [inline] + __handle_mm_fault+0x23b7/0x72b0 mm/memory.c:5285 + handle_mm_fault+0x27e/0x770 mm/memory.c:5450 + do_user_addr_fault arch/x86/mm/fault.c:1364 [inline] + handle_page_fault arch/x86/mm/fault.c:1507 [inline] + exc_page_fault+0x456/0x870 arch/x86/mm/fault.c:1563 + asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570 + +The root cause is: in f2fs_filemap_fault(), vmf->vma may be not alive after +filemap_fault(), so it may cause use-after-free issue when accessing +vmf->vma->vm_flags in trace_f2fs_filemap_fault(). So it needs to keep vm_flags +in separated temporary variable for tracepoint use. + +Fixes: 87f3afd366f7 ("f2fs: add tracepoint for f2fs_vm_page_mkwrite()") +Reported-and-tested-by: syzbot+763afad57075d3f862f2@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/lkml/000000000000e8222b060f00db3b@google.com +Cc: Ed Tsai +Suggested-by: Hillf Danton +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/file.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -50,6 +50,7 @@ static void f2fs_zero_post_eof_page(stru + static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf) + { + struct inode *inode = file_inode(vmf->vma->vm_file); ++ vm_flags_t flags = vmf->vma->vm_flags; + vm_fault_t ret; + + ret = filemap_fault(vmf); +@@ -57,7 +58,7 @@ static vm_fault_t f2fs_filemap_fault(str + f2fs_update_iostat(F2FS_I_SB(inode), inode, + APP_MAPPED_READ_IO, F2FS_BLKSIZE); + +- trace_f2fs_filemap_fault(inode, vmf->pgoff, vmf->vma->vm_flags, ret); ++ trace_f2fs_filemap_fault(inode, vmf->pgoff, flags, ret); + + return ret; + } diff --git a/queue-6.6/series b/queue-6.6/series index 9bd26d3896..1dffeeb31c 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -127,3 +127,4 @@ x86-bugs-add-a-transient-scheduler-attacks-mitigation.patch kvm-svm-advertise-tsa-cpuid-bits-to-guests.patch x86-microcode-amd-add-tsa-microcode-shas.patch x86-process-move-the-buffer-clearing-before-monitor.patch +f2fs-fix-to-avoid-use-after-free-issue-in-f2fs_filemap_fault.patch