From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-133.freemail.mail.aliyun.com (out30-133.freemail.mail.aliyun.com [115.124.30.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D7A453FCB3D for ; Tue, 19 May 2026 11:41:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.133 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779190911; cv=none; b=hJAj5hFy8EYn5iS4FvnRFVIfT1ktHcEVnJ3tPQ6DuaUtF0588oawIRH1E+KF/zoUdL6bt7cMEVnD9h77Mmkj6tMS9zOK5KM9cJ18jiSSL6Vd2g0/PjeGj/PRpycWzkyoEH8ZH6p/pDv8fiJmk+bjohCB6nN81a0HR6jET8XTV2M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779190911; c=relaxed/simple; bh=x0FZObFEJQMecuFLfQ5aokC2AnRbGjx0Y0tNcwlTzp8=; h=Message-ID:Date:MIME-Version:From:Subject:To:Cc:References: In-Reply-To:Content-Type; b=Iq6Z8w2TzPDgdiHpnAGCrxU+tL0DS7LcuwpvF+90ZErXg6rfMDsnH6WXwduTy5GvItdlYv+icqaSXJaDGZbztiWaHYPuvnwGmtN43bJkwNXNFI1xhUMKivTcmrLBA3950aFAT+himLnr66Xa7DgpoggBvDx74zbB+85GbhUL/x8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=gTtIJbvB; arc=none smtp.client-ip=115.124.30.133 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="gTtIJbvB" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1779190898; h=Message-ID:Date:MIME-Version:From:Subject:To:Content-Type; bh=d+QJmmiMIte50I3REC3l01Cof7rAoBBQjbipXcycwQo=; b=gTtIJbvBk+dXsY72OA5/rF9sH9mW2aqAWxPWRAwYQNPuMMTGEQ/e8Xj6GPVV4A6Sinr7Dp3yYkIhiSMK2Ha/xl6/mqe6cy9DMDBSFzRg0iwvQe02u71POH9vQqETZ2y4FCoJ4D2AIm6YK193g5fP5/cfBBF57fD32PadHaotOS8= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R161e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033037026112;MF=joseph.qi@linux.alibaba.com;NM=1;PH=DS;RN=5;SR=0;TI=SMTPD_---0X3FXdVr_1779190897; Received: from 30.221.130.5(mailfrom:joseph.qi@linux.alibaba.com fp:SMTPD_---0X3FXdVr_1779190897 cluster:ay36) by smtp.aliyun-inc.com; Tue, 19 May 2026 19:41:37 +0800 Message-ID: <878d31bf-a50c-4f48-a451-bcab0bb46c8f@linux.alibaba.com> Date: Tue, 19 May 2026 19:41:36 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird From: Joseph Qi Subject: Re: [PATCH] ocfs2: fix NULL deref in ocfs2_wait_for_recovery after recovery_exit To: Jiakai Xu Cc: Joel Becker , Mark Fasheh , "linux-kernel@vger.kernel.org" , "ocfs2-devel@lists.linux.dev" References: <20260519013629.1105967-1-xujiakai24@mails.ucas.ac.cn> In-Reply-To: <20260519013629.1105967-1-xujiakai24@mails.ucas.ac.cn> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 5/19/26 9:36 AM, Jiakai Xu wrote: > In ocfs2_recovery_exit(), the recovery_map is freed via kfree() but > osb->recovery_map is not set to NULL afterward. If ocfs2_wait_for_recovery() > is called subsequently (e.g. during inode eviction in the dismount path or evict_inodes() runs before ocfs2_recovery_exit(), which is called through put_super. > via a racing stat() syscall), ocfs2_recovery_completed() dereferences the > stale pointer, leading to a NULL pointer dereference at rm->rm_used. > > Fix this by: > 1. Setting osb->recovery_map = NULL after kfree() in ocfs2_recovery_exit() > 2. Adding a NULL guard in ocfs2_recovery_completed() so that it safely > returns "recovery completed" when the map has been freed > > Fixes: 553abd046af6 ("ocfs2: Change the recovery map to an array of node numbers.") > Signed-off-by: Jiakai Xu > --- > fs/ocfs2/journal.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c > index f9bf3bac085d..5529a177f90e 100644 > --- a/fs/ocfs2/journal.c > +++ b/fs/ocfs2/journal.c > @@ -243,6 +243,7 @@ void ocfs2_recovery_exit(struct ocfs2_super *osb) > /* XXX: Should we bug if there are dirty entries? */ > > kfree(rm); > + osb->recovery_map = NULL; > } > > static int __ocfs2_recovery_map_test(struct ocfs2_super *osb, > @@ -1225,6 +1226,9 @@ static int ocfs2_recovery_completed(struct ocfs2_super *osb) > int empty; > struct ocfs2_recovery_map *rm = osb->recovery_map; > Seems still cannot fully close the race? Thanks, Joseph > + if (!rm) > + return 1; > + > spin_lock(&osb->osb_lock); > empty = (rm->rm_used == 0); > spin_unlock(&osb->osb_lock);