Re: KASAN: use-after-free Read in path_lookupat

From: Al Viro
Date: Tue Mar 26 2019 - 00:15:20 EST


On Mon, Mar 25, 2019 at 08:18:25PM -0700, Mark Fasheh wrote:

> Hey Al,
>
> It's been a while since I've looked at that bit of code but it looks like
> Ocfs2 is syncing the inode to disk and disposing of it's memory
> representation (which would include the cluster locks held) so that other
> nodes get a chance to delete the potentially orphaned inode. In Ocfs2 we
> won't delete an inode if it exists in another nodes cache.

Wait a sec - what's the reason for forcing that write_inode_now(); why
doesn't the normal mechanism work? I'm afraid I still don't get it -
we do wait for writeback in evict_inode(), or the local filesystems
wouldn't work.