| commit | 38c0324c0fb6b53286f00b7e36d1edca70d863d8 | |
| author | Pavel Snajdr <snajpa@snajpa.net> | |
| Thu, 21 Nov 2024 23:30:43 +0000 (22 00:30 +0100) | ||
| committer | GitHub <noreply@github.com> | |
| Thu, 21 Nov 2024 23:30:43 +0000 (21 15:30 -0800) | ||
| tree | 386f2960bff2d8d98184b0631a3fe159e18327ef | treesnapshot (tar.gz zip) |
| parent | ae1d11882d10afb388e749684f8020b38de8504a | commitdiff |
Linux: Fix zfs_prune panics
by protecting against sb->s_shrink eviction on umount with newer kernels
deactivate_locked_super calls shrinker_free and only then
sops->kill_sb cb, resulting in UAF on umount when trying
to reach for the shrinker functions in zpl_prune_sb of
in-umount dataset
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Adam Moss <c@yotes.com>
Signed-off-by: Pavel Snajdr <snajpa@snajpa.net>
Closes #16770
by protecting against sb->s_shrink eviction on umount with newer kernels
deactivate_locked_super calls shrinker_free and only then
sops->kill_sb cb, resulting in UAF on umount when trying
to reach for the shrinker functions in zpl_prune_sb of
in-umount dataset
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Adam Moss <c@yotes.com>
Signed-off-by: Pavel Snajdr <snajpa@snajpa.net>
Closes #16770
| module/os/linux/zfs/zpl_super.c | diffblobblamehistory |