Re: [syzbot] [lsm?] general protection fault in smack_inode_permission (4)

[syzbot <syzbot+fc1d5d9a7ebabbc27458@syzkaller.appspotmail.com>]

> #syz test: 

This crash does not have a reproducer. I cannot test it.

> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> Try reverting the kmalloc introducer patch
>
> diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
> index ac0f79fafaca..8ce6e4458cc2 100644
> --- a/fs/jfs/jfs_dtree.c
> +++ b/fs/jfs/jfs_dtree.c
> @@ -2729,7 +2729,7 @@ int jfs_readdir(struct file *file, struct dir_context 
> *ctx)
>   struct ldtentry *d;
>   struct dtslot *t;
>   int d_namleft, len, outlen;
> - unsigned long dirent_buf;
> + void *dirent_buf;
>   char *name_ptr;
>   u32 dir_index;
>   int do_index = 0;
> @@ -2884,7 +2884,7 @@ int jfs_readdir(struct file *file, struct dir_context 
> *ctx)
>   }
>   }
>  
> - dirent_buf = __get_free_page(GFP_KERNEL);
> + dirent_buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
>   if (dirent_buf == 0) {
>   DT_PUTPAGE(mp);
>   jfs_warn("jfs_readdir: __get_free_page failed!");
> @@ -2893,7 +2893,7 @@ int jfs_readdir(struct file *file, struct dir_context 
> *ctx)
>   }
>  
>   while (1) {
> - jfs_dirent = (struct jfs_dirent *) dirent_buf;
> + jfs_dirent = dirent_buf;
>   jfs_dirents = 0;
>   overflow = fix_page = 0;
>  
> @@ -2903,7 +2903,7 @@ int jfs_readdir(struct file *file, struct dir_context 
> *ctx)
>   if (stbl[i] < 0) {
>   jfs_err("JFS: Invalid stbl[%d] = %d for inode %ld, block = %lld",
>   i, stbl[i], (long)ip->i_ino, (long long)bn);
> - free_page(dirent_buf);
> + kfree(dirent_buf);
>   DT_PUTPAGE(mp);
>   return -EIO;
>   }
> @@ -2911,7 +2911,7 @@ int jfs_readdir(struct file *file, struct dir_context 
> *ctx)
>   d = (struct ldtentry *) & p->slot[stbl[i]];
>  
>   if (((long) jfs_dirent + d->namlen + 1) >
> -     (dirent_buf + PAGE_SIZE)) {
> +     ((long)dirent_buf + PAGE_SIZE)) {
>   /* DBCS codepages could overrun dirent_buf */
>   index = i;
>   overflow = 1;
> @@ -3014,7 +3014,7 @@ int jfs_readdir(struct file *file, struct dir_context 
> *ctx)
>   /* unpin previous leaf page */
>   DT_PUTPAGE(mp);
>  
> - jfs_dirent = (struct jfs_dirent *) dirent_buf;
> + jfs_dirent = dirent_buf;
>   while (jfs_dirents--) {
>   ctx->pos = jfs_dirent->position;
>   if (!dir_emit(ctx, jfs_dirent->name,
> @@ -3037,13 +3037,13 @@ int jfs_readdir(struct file *file, struct 
> dir_context *ctx)
>  
>   DT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
>   if (rc) {
> - free_page(dirent_buf);
> + kfree(dirent_buf);
>   return rc;
>   }
>   }
>  
>        out:
> - free_page(dirent_buf);
> + kfree(dirent_buf);
>  
>   return rc;
>  }
> diff --git a/fs/jfs/super.c b/fs/jfs/super.c
> index 61575f7397ae..8180d83d33fe 100644
> --- a/fs/jfs/super.c
> +++ b/fs/jfs/super.c
> @@ -491,7 +491,8 @@ static int jfs_fill_super(struct super_block *sb, 
> struct fs_context *fc)
>   /*
>    * Initialize blocksize to 4K.
>    */
> - sb_set_blocksize(sb, PSIZE);
> + if (!sb_set_blocksize(sb, PSIZE))
> + goto out_unload;
>  
>   /*
>    * Set method vectors.
>
> -- 
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-bugs/716cc2d6-0468-48db-967e-0b3c9048ac47n%40googlegroups.com.