diff options
| author | Jann Horn <jannh@google.com> | 2023-01-16 22:14:25 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-03-10 11:33:46 +0300 |
| commit | 377f7d85bd276a0eb8e460d6e611412d8ba13b8f (patch) | |
| tree | b1b9bd2ffab6aa94bf08d6e8d2ba51c9b8e4fdd6 /fs/open.c | |
| parent | f2a6198f5ed7d6e4e06d87a4de007f2e45cc9583 (diff) | |
| download | linux-377f7d85bd276a0eb8e460d6e611412d8ba13b8f.tar.xz | |
fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
[ Upstream commit 47d586913f2abec4d240bae33417f537fda987ec ]
Currently, filp_close() and generic_shutdown_super() use printk() to log
messages when bugs are detected. This is problematic because infrastructure
like syzkaller has no idea that this message indicates a bug.
In addition, some people explicitly want their kernels to BUG() when kernel
data corruption has been detected (CONFIG_BUG_ON_DATA_CORRUPTION).
And finally, when generic_shutdown_super() detects remaining inodes on a
system without CONFIG_BUG_ON_DATA_CORRUPTION, it would be nice if later
accesses to a busy inode would at least crash somewhat cleanly rather than
walking through freed memory.
To address all three, use CHECK_DATA_CORRUPTION() when kernel bugs are
detected.
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs/open.c')
| -rw-r--r-- | fs/open.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/fs/open.c b/fs/open.c index 9d0197db15e7..20717ec510c0 100644 --- a/fs/open.c +++ b/fs/open.c @@ -1411,8 +1411,9 @@ int filp_close(struct file *filp, fl_owner_t id) { int retval = 0; - if (!file_count(filp)) { - printk(KERN_ERR "VFS: Close: file count is 0\n"); + if (CHECK_DATA_CORRUPTION(file_count(filp) == 0, + "VFS: Close: file count is 0 (f_op=%ps)", + filp->f_op)) { return 0; } |