diff options
| author | Jann Horn <jannh@google.com> | 2023-01-16 20:14:25 +0100 |
|---|---|---|
| committer | Christian Brauner (Microsoft) <brauner@kernel.org> | 2023-01-27 14:17:22 +0100 |
| commit | 47d586913f2abec4d240bae33417f537fda987ec (patch) | |
| tree | 7471e6d7d4bd383ae9770bd9ca14a0933c04c34b /fs/open.c | |
| parent | 1b929c02afd37871d5afb9d498426f83432e71c2 (diff) | |
| download | lwn-47d586913f2abec4d240bae33417f537fda987ec.tar.gz lwn-47d586913f2abec4d240bae33417f537fda987ec.zip | |
fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
Currently, filp_close() and generic_shutdown_super() use printk() to log
messages when bugs are detected. This is problematic because infrastructure
like syzkaller has no idea that this message indicates a bug.
In addition, some people explicitly want their kernels to BUG() when kernel
data corruption has been detected (CONFIG_BUG_ON_DATA_CORRUPTION).
And finally, when generic_shutdown_super() detects remaining inodes on a
system without CONFIG_BUG_ON_DATA_CORRUPTION, it would be nice if later
accesses to a busy inode would at least crash somewhat cleanly rather than
walking through freed memory.
To address all three, use CHECK_DATA_CORRUPTION() when kernel bugs are
detected.
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Diffstat (limited to 'fs/open.c')
| -rw-r--r-- | fs/open.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/fs/open.c b/fs/open.c index 82c1a28b3308..ceb88ac0ca3b 100644 --- a/fs/open.c +++ b/fs/open.c @@ -1411,8 +1411,9 @@ int filp_close(struct file *filp, fl_owner_t id) { int retval = 0; - if (!file_count(filp)) { - printk(KERN_ERR "VFS: Close: file count is 0\n"); + if (CHECK_DATA_CORRUPTION(file_count(filp) == 0, + "VFS: Close: file count is 0 (f_op=%ps)", + filp->f_op)) { return 0; } |