Re: [PATCH] ocfs2: fix use-after-free when unmounting read-only filesystem

[Joseph Qi]

On 5/22/23 9:22 PM, Luís Henriques wrote:
> Heming Zhao <heming.zhao@xxxxxxxx> writes:
> 
>> On Mon, May 22, 2023 at 01:23:07PM +0100, Luís Henriques wrote:
>>> Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx> writes:
>>>
>>>> On 5/22/23 6:25 PM, Luís Henriques wrote:
>>>>> It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using
>>>>> fstest generic/452.  After mounting a filesystem as read-only, quotas are
>>>>
>>>> generic/452 is for testing ext4 mounted with dax and ro.
>>>> But ocfs2 doesn't support dax yet.
>>>
>>> Right, but I think it's still useful to run the 'generic' test-suite in a
>>> filesystem.  We can always find issues in the test itself or, in this
>>> case, a bug in the filesystem.
>>
>> It looks you did some special steps for 452. In my env, without changing
>> anything, I could pass this case successfully. 
> 
> No, I haven't changed anything to the test.  I just make sure there's a
> scratch device to be used.
> 
> Maybe you can try to enable KASAN to catch the UAF.  I've found the bug
> without KASAN (i.e. I saw a NULL pointer panic), but enabling it also
> detects the issue -- see below.
> 
> Cheers,

We'd better append panic dmesg to patch description as well.

Thanks,
Joseph