diff options
| author | Bruno Produit <bruno.produit@trailofbits.com> | 2026-09-21 17:37:29 +0200 |
|---|---|---|
| committer | Viacheslav Dubeyko <slava@dubeyko.com> | 2026-09-25 12:21:29 -0700 |
| commit | dce0e0248205bb3dc5b4c6793cd2ecb453152259 (patch) | |
| tree | dbe082140a106e17fa36eab589df86c71a6b16d2 /tools/perf/scripts/python/bin/stackcollapse-report | |
| parent | 21668258995bdc99b48f372c2d7d52539c2f2567 (diff) | |
| download | linux-dce0e0248205bb3dc5b4c6793cd2ecb453152259.tar.gz linux-dce0e0248205bb3dc5b4c6793cd2ecb453152259.zip | |
hfs/hfsplus: serialize B-tree close against folio release
B-tree nodes with a zero reference count remain in the node hash until
folio reclaim or tree teardown frees them. The folio release callbacks
remove nodes while holding hash_lock, but hfs_btree_close() walks and
frees the same hash without that lock. Reclaim can therefore unhash and
free a node after close has loaded its pointer, causing a use-after-free
or double-free.
The following syzkaller crashes seem to be the same UAF in
{hfs,hfsplus}_btree_close() (or {hfs,hfsplus}_bnode_unhash()) and follow
the same pattern, but do not contain a reproducer to confirm.
Detach each node with hfs_bnode_unhash() while holding hash_lock before
inspecting and freeing it. Drop the lock before hfs_bnode_free() so a
large tree is not freed while holding a spinlock. Apply the same fix to
the matching HFS+ implementation.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+d729df28d933979e017a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d729df28d933979e017a
Reported-by: syzbot+2eac7d175baf21e6a5d5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2eac7d175baf21e6a5d5
Reported-by: syzbot+7155b2fe09e033c91381@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7155b2fe09e033c91381
Reported-by: syzbot+adeb387cede15eb11607@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=adeb387cede15eb11607
Reported-by: syzbot+ae7f2423f3648100506d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ae7f2423f3648100506d
Assisted-by: Codex:gpt-5.6-sol
Reported-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Bruno Produit <bruno.produit@trailofbits.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Tested-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260921153729.600313-1-bruno.produit@trailofbits.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Diffstat (limited to 'tools/perf/scripts/python/bin/stackcollapse-report')
0 files changed, 0 insertions, 0 deletions