Skip to content

Commit

Permalink
Linux: Fix zfs_prune panics
Browse files Browse the repository at this point in the history
by protecting against sb->s_shrink eviction on umount with newer kernels

deactivate_locked_super calls shrinker_free and only then
sops->kill_sb cb, resulting in UAF on umount when trying
to reach for the shrinker functions in zpl_prune_sb of
in-umount dataset

Signed-off-by: Pavel Snajdr <[email protected]>
  • Loading branch information
snajpa committed Nov 15, 2024
1 parent de2e9a5 commit d928d85
Showing 1 changed file with 5 additions and 1 deletion.
6 changes: 5 additions & 1 deletion module/os/linux/zfs/zpl_super.c
Original file line number Diff line number Diff line change
Expand Up @@ -375,7 +375,11 @@ zpl_prune_sb(uint64_t nr_to_scan, void *arg)
struct super_block *sb = (struct super_block *)arg;
int objects = 0;

(void) -zfs_prune(sb, nr_to_scan, &objects);
if (atomic_inc_not_zero(&sb->s_active)) {
(void) -zfs_prune(sb, nr_to_scan, &objects);
atomic_dec(&sb->s_active);
}

}

const struct super_operations zpl_super_operations = {
Expand Down

0 comments on commit d928d85

Please sign in to comment.