Chandan Rajendra ef7ce82bc2 ext4: fix crash when a directory's i_size is too small ...

commit 9d5afec6b8bd46d6ed821aa1579634437f58ef1f upstream.

On a ppc64 machine, when mounting a fuzzed ext2 image (generated by
fsfuzzer) the following call trace is seen,

VFS: brelse: Trying to free free buffer
WARNING: CPU: 1 PID: 6913 at /root/repos/linux/fs/buffer.c:1165 .__brelse.part.6+0x24/0x40
.__brelse.part.6+0x20/0x40 (unreliable)
.ext4_find_entry+0x384/0x4f0
.ext4_lookup+0x84/0x250
.lookup_slow+0xdc/0x230
.walk_component+0x268/0x400
.path_lookupat+0xec/0x2d0
.filename_lookup+0x9c/0x1d0
.vfs_statx+0x98/0x140
.SyS_newfstatat+0x48/0x80
system_call+0x58/0x6c

This happens because the directory that ext4_find_entry() looks up has
inode->i_size that is less than the block size of the filesystem. This
causes 'nblocks' to have a value of zero. ext4_bread_batch() ends up not
reading any of the directory file's blocks. This renders the entries in
bh_use[] array to continue to have garbage data. buffer_uptodate() on
bh_use[0] can then return a zero value upon which brelse() function is
invoked.

This commit fixes the bug by returning -ENOENT when the directory file
has no associated blocks.

Reported-by: Abdul Haleem <abdhalee@linux.vnet.ibm.com>
Signed-off-by: Chandan Rajendra <chandan@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-12-20 10:04:52 +01:00

..

9p

fs/9p: Compare qid.path in v9fs_test_inode

2017-11-30 08:37:22 +00:00

adfs

fs/adfs: remove unneeded cast

2015-06-30 19:44:57 -07:00

affs

affs: fix remount failure when there are no options changed

2016-06-07 18:14:32 -07:00

afs

afs: Connect up the CB.ProbeUuid

2017-12-16 10:33:56 +01:00

autofs4

autofs: fix careless error in recent commit

2017-12-20 10:04:51 +01:00

befs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

bfs

…

btrfs

btrfs: clear space cache inode generation always

2017-12-05 11:22:50 +01:00

cachefiles

FS-Cache: Add missing initialization of ret in cachefiles_write_page()

2015-11-16 20:38:43 -05:00

ceph

ceph: drop negative child dentries before try pruning inode's alias

2017-12-20 10:04:52 +01:00

cifs

cifs: check MaxPathNameComponentLength != 0 before using it

2017-11-08 10:06:27 +01:00

coda

coda: fix 'kernel memory exposure attempt' in fsync

2017-11-24 08:32:25 +01:00

configfs

configfs: Fix race between create_link and configfs_rmdir

2017-06-26 07:13:08 +02:00

cramfs

…

debugfs

dentry name snapshots

2017-08-06 19:19:42 -07:00

devpts

devpts: clean up interface to pty drivers

2016-08-16 09:30:49 +02:00

dlm

dlm: avoid double-free on error path in dlm_device_{register,unregister}

2017-09-13 14:09:45 -07:00

ecryptfs

eCryptfs: use after free in ecryptfs_release_messaging()

2017-11-30 08:37:20 +00:00

efivarfs

efi: Make efivarfs entries immutable by default

2016-03-03 15:07:09 -08:00

efs

fs/efs: femove unneeded cast

2015-06-25 17:00:42 -07:00

exofs

osd fs: __r4w_get_page rely on PageUptodate for uptodate

2015-12-12 10:15:34 -08:00

exportfs

…

ext2

posix_acl: Clear SGID bit when setting file permissions

2016-10-31 04:13:58 -06:00

ext4

ext4: fix crash when a directory's i_size is too small

2017-12-20 10:04:52 +01:00

f2fs

fscrypto: require write access to mount to set encryption policy

2017-10-27 10:23:18 +02:00

fat

fat: fix using uninitialized fields of fat_inode/fsinfo_inode

2017-03-15 09:57:15 +08:00

freevxfs

freevxfs: Grammar s/an negative/a negative/

2015-08-07 13:59:24 +02:00

fscache

FS-Cache: fix dereference of NULL user_key_payload

2017-10-27 10:23:18 +02:00

fuse

fuse: fix READDIRPLUS skipping an entry

2017-11-02 09:40:49 +01:00

gfs2

GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next

2017-10-08 10:14:16 +02:00

hfs

hfs: fix B-tree corruption after insertion at position 0

2015-09-10 13:29:01 -07:00

hfsplus

posix_acl: Clear SGID bit when setting file permissions

2016-10-31 04:13:58 -06:00

hostfs

hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()

2016-09-30 10:18:39 +02:00

hpfs

hpfs: implement the show_options method

2016-06-01 12:15:54 -07:00

hugetlbfs

mm: larger stack guard gap, between vmas

2017-06-26 07:13:11 +02:00

isofs

isofs: fix timestamps beyond 2027

2017-11-30 08:37:20 +00:00

jbd2

jbd2: don't leak modified metadata buffers on an aborted journal

2017-03-12 06:37:26 +01:00

jffs2

posix_acl: Clear SGID bit when setting file permissions

2016-10-31 04:13:58 -06:00

jfs

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

kernfs

kernfs: don't depend on d_find_any_alias() when generating notifications

2016-09-24 10:07:36 +02:00

lockd

Mainly smaller bugfixes and cleanup. We're still finding some bugs from

2015-11-11 20:11:28 -08:00

logfs

mm, fs: introduce mapping_gfp_constraint()

2015-11-06 17:50:42 -08:00

minix

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

ncpfs

ncpfs: fix a braino in OOM handling in ncp_fill_cache()

2016-03-16 08:42:59 -07:00

nfs

NFS: Fix a typo in nfs_rename()

2017-12-16 10:33:55 +01:00

nfs_common

lockd: NLM grace period shouldn't block NFSv4 opens

2015-08-13 10:22:06 -04:00

nfsd

nfsd: Fix another OPEN stateid race

2017-12-05 11:22:52 +01:00

nilfs2

nilfs2: fix race condition that causes file system corruption

2017-11-30 08:37:20 +00:00

nls

…

notify

dentry name snapshots

2017-08-06 19:19:42 -07:00

ntfs

mm, fs: introduce mapping_gfp_constraint()

2015-11-06 17:50:42 -08:00

ocfs2

Revert "ocfs2: should wait dio before inode lock in ocfs2_setattr()"

2017-12-09 18:42:43 +01:00

omfs

…

openpromfs

…

overlayfs

ovl: fsync after copy-up

2016-11-10 16:36:34 +01:00

proc

mm: larger stack guard gap, between vmas

2017-06-26 07:13:11 +02:00

pstore

pstore: Use dynamic spinlock initializer

2017-08-06 19:19:43 -07:00

qnx4

…

qnx6

…

quota

quota: Fix possible GPF due to uninitialised pointers

2016-04-12 09:08:56 -07:00

ramfs

mm, fs: obey gfp_mapping for add_to_page_cache()

2015-10-16 11:42:28 -07:00

reiserfs

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

romfs

romfs: use different way to generate fsid for BLOCK or MTD

2017-06-17 06:39:38 +02:00

squashfs

squashfs: xattr simplifications

2015-11-13 20:34:33 -05:00

sysfs

sysfs: be careful of error returns from ops->show()

2017-04-12 12:38:33 +02:00

sysv

fix sysvfs symlinks

2015-11-23 21:11:08 -05:00

tracefs

tracefs: Fix refcount imbalance in start_creating()

2015-11-04 22:13:45 -05:00

ubifs

ubifs: Fix journal replay wrt. xattr nodes

2017-01-26 08:23:48 +01:00

udf

udf: Fix deadlock between writeback and udf_setsize()

2017-07-27 15:06:09 -07:00

ufs

ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path

2017-06-14 13:16:24 +02:00

xfs

xfs: remove kmem_zalloc_greedy

2017-10-08 10:14:20 +02:00

aio.c

aio: mark AIO pseudo-fs noexec

2016-10-07 15:23:47 +02:00

anon_inodes.c

…

attr.c

vfs: move permission checking into notify_change() for utimes(NULL)

2016-10-22 12:26:56 +02:00

bad_inode.c

…

binfmt_aout.c

…

binfmt_elf_fdpic.c

libnvdimm for 4.4:

2015-11-10 12:07:22 -08:00

binfmt_elf.c

binfmt_elf: use ELF_ET_DYN_BASE only for PIE

2017-07-21 07:44:57 +02:00

binfmt_em86.c

…

binfmt_flat.c

…

binfmt_misc.c

…

binfmt_script.c

…

block_dev.c

fs/block_dev: always invalidate cleancache in invalidate_bdev()

2017-05-20 14:27:01 +02:00

buffer.c

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

char_dev.c

fs/char_dev.c: fix incorrect documentation for unregister_chrdev_region

2015-08-05 13:49:35 -07:00

compat_binfmt_elf.c

…

compat_ioctl.c

i2c-dev: Fix typo in ioctl name reference

2015-10-23 23:26:43 +02:00

compat.c

…

coredump.c

coredump: Ensure proper size of sparse core files

2017-07-05 14:37:20 +02:00

dax.c

dax: disable pmd mappings

2015-11-16 23:54:45 -08:00

dcache.c

dentry name snapshots

2017-08-06 19:19:42 -07:00

dcookies.c

…

direct-io.c

direct-io: Prevent NULL pointer access in submit_page_section

2017-10-18 09:20:42 +02:00

drop_caches.c

inode: convert inode_sb_list_lock to per-sb

2015-08-17 18:39:46 -04:00

eventfd.c

…

eventpoll.c

epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()

2017-09-07 08:34:10 +02:00

exec.c

exec: Limit arg stack to at most 75% of _STK_LIM

2017-07-21 07:44:57 +02:00

fcntl.c

fs: add a VALID_OPEN_FLAGS

2017-07-15 11:57:44 +02:00

fhandle.c

fs/coredump: prevent fsuid=0 dumps into user-controlled directories

2016-04-12 09:08:58 -07:00

file_table.c

fs, file table: reinit files_stat.max_files after deferred memory initialisation

2015-08-07 04:39:40 +03:00

file.c

vfs: clear remainder of 'full_fds_bits' in dup_fd()

2015-11-05 23:05:32 -08:00

filesystems.c

…

fs_pin.c

…

fs_struct.c

…

fs-writeback.c

writeback, cgroup: fix use of the wrong bdi_writeback which mismatches the inode

2016-04-12 09:09:04 -07:00

inode.c

vfs: fix deadlock in file_remove_privs() on overlayfs

2016-08-10 11:49:30 +02:00

internal.h

inode: rename i_wb_list to i_io_list

2015-08-17 23:38:10 -04:00

ioctl.c

…

Kconfig

dax: disable pmd mappings

2015-11-16 23:54:45 -08:00

Kconfig.binfmt

…

libfs.c

fs: Set the size of empty dirs to 0.

2015-08-12 15:28:45 -05:00

locks.c

locks: use file_inode()

2016-08-10 11:49:27 +02:00

Makefile

ext4: promote ext4 over ext2 in the default probe order

2015-10-15 10:33:21 -04:00

mbcache.c

…

mount.h

mnt: In propgate_umount handle visiting mounts in any order

2017-07-21 07:44:57 +02:00

mpage.c

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

namei.c

dentry name snapshots

2017-08-06 19:19:42 -07:00

namespace.c

mnt: In propgate_umount handle visiting mounts in any order

2017-07-21 07:44:57 +02:00

no-block.c

…

nsfs.c

fs/seq_file: convert int seq_vprint/seq_printf/etc... returns to void

2015-09-11 15:21:34 -07:00

open.c

fs: completely ignore unknown open flags

2017-07-15 11:57:44 +02:00

pipe.c

pipe: limit the per-user amount of pages allocated in pipes

2016-06-07 18:14:35 -07:00

pnode.c

mnt: Make propagate_umount less slow for overlapping mount propagation trees

2017-07-21 07:44:58 +02:00

pnode.h

mnt: Add a per mount namespace limit on the number of mounts

2017-04-30 05:49:28 +02:00

posix_acl.c

tmpfs: clear S_ISGID when setting posix ACLs

2017-01-26 08:23:47 +01:00

proc_namespace.c

vfs: show_vfsstat: do not ignore errors from show_devname method

2016-04-12 09:08:55 -07:00

read_write.c

vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets

2017-10-05 09:41:45 +02:00

readdir.c

…

select.c

…

seq_file.c

Make file credentials available to the seqfile interfaces

2017-08-06 19:19:42 -07:00

signalfd.c

signalfd: fix information leak in signalfd_copyinfo

2015-08-07 04:39:40 +03:00

splice.c

vfs: fix uninitialized flags in splice_to_pipe()

2017-02-23 17:43:09 +01:00

stack.c

…

stat.c

ufs: restore maintaining ->i_blocks

2017-06-14 13:16:24 +02:00

statfs.c

…

super.c

fs/super.c: fix race between freeze_super() and thaw_super()

2016-10-28 03:01:32 -04:00

sync.c

fs/sync.c: make sync_file_range(2) use WB_SYNC_NONE writeback

2015-11-06 17:50:42 -08:00

timerfd.c

timerfd: Protect the might cancel mechanism proper

2017-05-08 07:46:01 +02:00

userfaultfd.c

userfaultfd: don't block on the last VM updates at exit time

2016-03-16 08:43:01 -07:00

utimes.c

vfs: move permission checking into notify_change() for utimes(NULL)

2016-10-22 12:26:56 +02:00

xattr.c

lsm: fix smack_inode_removexattr and xattr_getsecurity memleak

2017-10-12 11:27:32 +02:00