iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Theodore Ts'o f30f3391d0 ext4: fix invalid free tracking in ext4_xattr_move_to_block() 
commit b87c7cdf2bed4928b899e1ce91ef0d147017ba45 upstream.

In ext4_xattr_move_to_block(), the value of the extended attribute
which we need to move to an external block may be allocated by
kvmalloc() if the value is stored in an external inode.  So at the end
of the function the code tried to check if this was the case by
testing entry->e_value_inum.

However, at this point, the pointer to the xattr entry is no longer
valid, because it was removed from the original location where it had
been stored.  So we could end up calling kvfree() on a pointer which
was not allocated by kvmalloc(); or we could also potentially leak
memory by not freeing the buffer when it should be freed.  Fix this by
storing whether it should be freed in a separate variable.

Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20230430160426.581366-1-tytso@mit.edu
Link: https://syzkaller.appspot.com/bug?id=5c2aee8256e30b55ccf57312c16d88417adbd5e1
Link: https://syzkaller.appspot.com/bug?id=41a6b5d4917c0412eb3b3c3c604965bed7d7420b
Reported-by: syzbot+64b645917ce07d89bde5@syzkaller.appspotmail.com
Reported-by: syzbot+0d042627c4f2ad332195@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-17 11:13:27 +02:00
..
9p
9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"
2022-06-25 11:48:57 +02:00
adfs
fs/adfs: super: fix use-after-free bug
2019-08-06 19:06:49 +02:00
affs
affs: initialize fsdata in affs_truncate()
2023-02-06 07:49:38 +01:00
afs
afs: Fix dynamic root getattr
2022-07-02 16:27:33 +02:00
autofs
autofs: fix a leak in autofs_expire_indirect()
2019-12-13 08:51:01 +01:00
befs
…
bfs
…
btrfs
btrfs: print-tree: parent bytenr must be aligned to sector size
2023-05-17 11:13:25 +02:00
cachefiles
cachefiles: Handle readpage error correctly
2020-11-05 11:08:54 +01:00
ceph
ceph: avoid putting the realm twice when decoding snaps fails
2022-12-08 11:18:31 +01:00
cifs
cifs: fix pcchunk length type in smb2_copychunk_range
2023-05-17 11:13:25 +02:00
coda
coda: add error handling for fget
2019-08-06 19:06:51 +02:00
configfs
configfs: fix a race in configfs_{,un}register_subsystem()
2022-03-02 11:38:13 +01:00
cramfs
…
crypto
fscrypt: add fscrypt_symlink_getattr() for computing st_size
2021-09-22 11:47:56 +02:00
debugfs
debugfs: regset32: Add Runtime PM support
2023-05-17 11:13:06 +02:00
devpts
fs/devpts: always delete dcache dentry-s in dput()
2019-03-23 20:09:59 +01:00
dlm
fs: dlm: handle -EBUSY first in lock arg validation
2022-10-26 13:19:21 +02:00
ecryptfs
Revert "ecryptfs: replace BUG_ON with error handling code"
2021-05-26 11:48:34 +02:00
efivarfs
efivarfs: revert "fix memory leak in efivarfs_create()"
2020-12-02 08:48:12 +01:00
efs
…
exofs
exofs_mount(): fix leaks on failure exits
2019-12-05 09:20:32 +01:00
exportfs
exportfs: fix 'passing zero to ERR_PTR()' warning
2020-01-27 14:50:02 +01:00
ext2
ext2: Add more validity checks for inode counts
2022-08-25 11:14:58 +02:00
ext4
ext4: fix invalid free tracking in ext4_xattr_move_to_block()
2023-05-17 11:13:27 +02:00
f2fs
f2fs: fix cgroup writeback accounting with fs-layer encryption
2023-03-11 16:32:02 +01:00
fat
fat: add ratelimit to fat*_ent_bread()
2022-06-14 16:59:18 +02:00
freevxfs
…
fscache
fscache: Fix cookie key hashing
2021-09-22 11:48:02 +02:00
fuse
fuse: limit nsec
2022-08-25 11:14:55 +02:00
gfs2
gfs2: Always check inode size of inline inodes
2023-04-05 11:15:42 +02:00
hfs
hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
2023-03-11 16:31:49 +01:00
hfsplus
fs: hfsplus: fix UAF issue in hfsplus_put_super
2023-03-11 16:31:49 +01:00
hostfs
…
hpfs
…
hugetlbfs
hugetlbfs: hugetlb_fault_mutex_hash() cleanup
2021-06-03 08:38:12 +02:00
isofs
isofs: Fix out of bound access for corrupted isofs image
2021-11-12 14:40:50 +01:00
jbd2
jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
2022-08-25 11:15:19 +02:00
jffs2
jffs2: correct logic when creating a hole in jffs2_write_begin
2023-03-22 13:27:11 +01:00
jfs
fs/jfs: fix shift exponent db_agl2size negative
2023-03-11 16:31:55 +01:00
kernfs
kernfs: fix use-after-free in __kernfs_remove
2022-11-03 23:52:29 +09:00
lockd
lockd: don't use interval-based rebinding over TCP
2020-12-30 11:25:59 +01:00
minix
minix: fix bug when opening a file with O_DIRECT
2022-04-15 14:15:03 +02:00
nfs
NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease
2023-05-17 11:13:19 +02:00
nfs_common
nfs_common: need lock during iterate through the list
2020-12-30 11:26:02 +01:00
nfsd
nfsd: fix race to check ls_layouts
2023-03-11 16:31:42 +01:00
nilfs2
nilfs2: fix infinite loop in nilfs_mdt_get_block()
2023-05-17 11:13:20 +02:00
nls
…
notify
fsnotify: fix wrong lockdep annotations
2022-06-14 16:59:20 +02:00
ntfs
ntfs: check overflow when iterating ATTR_RECORDs
2022-11-25 17:40:30 +01:00
ocfs2
ocfs2: fix data corruption after failed write
2023-04-05 11:15:38 +02:00
omfs
…
openpromfs
…
orangefs
orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
2023-01-18 11:30:37 +01:00
overlayfs
ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
2023-01-18 11:30:40 +01:00
proc
mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
2023-02-22 12:47:15 +01:00
pstore
pstore: Revert pmsg_lock back to a normal mutex
2023-05-17 11:13:15 +02:00
qnx4
qnx4: work around gcc false positive warning bug
2021-10-06 15:31:20 +02:00
qnx6
…
quota
ext4: fix bug_on in __es_tree_search caused by bad quota inode
2023-01-18 11:30:53 +01:00
ramfs
ramfs: fix nommu mmap with gaps in the page cache
2020-10-30 10:38:21 +01:00
reiserfs
reiserfs: Add security prefix to xattr name in reiserfs_security_write()
2023-05-17 11:13:07 +02:00
romfs
romfs: fix uninitialized memory leak in romfs_dev_read()
2020-08-26 10:30:59 +02:00
squashfs
revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
2023-02-22 12:47:20 +01:00
sysfs
fs: sysfs_emit_at: Remove PAGE_SIZE alignment check
2023-03-22 13:27:08 +01:00
sysv
fs: sysv: Fix sysv_nblocks() returns wrong value
2023-01-18 11:30:08 +01:00
tracefs
tracefs: Only clobber mode/uid/gid on remount if asked
2022-09-20 12:26:48 +02:00
ubifs
ubifs: Free memory for tmpfile name
2023-05-17 11:13:08 +02:00
udf
udf: Detect system inodes linked into directory hierarchy
2023-03-17 08:31:42 +01:00
ufs
fs/ufs: avoid potential u32 multiplication overflow
2020-08-21 11:05:38 +02:00
xfs
xfs: remove incorrect ASSERT in xfs_rename
2022-07-12 16:29:02 +02:00
aio.c
aio: fix mremap after fork null-deref
2023-02-22 12:47:19 +01:00
anon_inodes.c
…
attr.c
vfs: Check the truncate maximum size in inode_newsize_ok()
2022-08-25 11:14:53 +02:00
bad_inode.c
…
binfmt_aout.c
binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf
2023-01-18 11:30:42 +01:00
binfmt_elf_fdpic.c
binfmt: Fix error return code in load_elf_fdpic_binary()
2023-01-18 11:30:42 +01:00
binfmt_elf.c
elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings
2021-10-06 15:31:24 +02:00
binfmt_em86.c
…
binfmt_flat.c
binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf
2023-01-18 11:30:42 +01:00
binfmt_misc.c
binfmt_misc: fix shift-out-of-bounds in check_special_flags
2023-01-18 11:30:33 +01:00
binfmt_script.c
exec: load_script: Do not exec truncated interpreter path
2019-11-06 13:05:37 +01:00
block_dev.c
block: reexpand iov_iter after read/write
2021-05-22 10:59:49 +02:00
buffer.c
mm: fs: initialize fsdata passed to write_begin/write_end interface
2022-11-25 17:40:29 +01:00
char_dev.c
chardev: fix error handling in cdev_device_add()
2023-01-18 11:30:27 +01:00
compat_binfmt_elf.c
…
compat_ioctl.c
fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP
2020-01-09 10:19:07 +01:00
compat.c
…
coredump.c
coredump: fix crash when umh is disabled
2020-05-14 07:57:21 +02:00
d_path.c
…
dax.c
dax: fix cache flush on PMD-mapped pages
2022-06-14 16:59:24 +02:00
dcache.c
fs, fscrypt: clear DCACHE_ENCRYPTED_NAME when unaliasing directory
2020-11-05 11:08:35 +01:00
dcookies.c
…
direct-io.c
fs: direct-io: fix missing sdio->boundary
2021-04-14 08:22:32 +02:00
drop_caches.c
fs: avoid softlockups in s_inodes iterators
2020-01-12 12:17:20 +01:00
eventfd.c
eventfd: track eventfd_signal() recursion depth
2020-02-11 04:34:08 -08:00
eventpoll.c
ep_create_wakeup_source(): dentry name can change under you...
2020-10-07 08:00:09 +02:00
exec.c
exec: Force single empty string when argv is empty
2022-06-06 08:24:21 +02:00
fcntl.c
fcntl: fix potential deadlock for &fasync_struct.fa_lock
2021-09-22 11:47:50 +02:00
fhandle.c
…
file_table.c
fs: add fget_many() and fput_many()
2021-12-08 08:50:13 +01:00
file.c
fs: prevent out-of-bounds array speculation when closing a file descriptor
2023-03-17 08:31:41 +01:00
filesystems.c
fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
2020-04-17 10:48:51 +02:00
fs_pin.c
…
fs_struct.c
…
fs-writeback.c
writeback: fix call of incorrect macro
2023-05-17 11:13:23 +02:00
inode.c
fs: fix UAF/GPF bug in nilfs_mdt_destroy
2022-10-26 13:19:16 +02:00
internal.h
acct_on(): don't mess with freeze protection
2019-05-31 06:46:05 -07:00
ioctl.c
…
iomap.c
iomap: fix sub-page uptodate handling
2021-05-22 10:59:50 +02:00
Kconfig
…
Kconfig.binfmt
…
libfs.c
libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
2023-01-18 11:30:06 +01:00
locks.c
locks: print unsigned ino in /proc/locks
2020-01-09 10:19:00 +01:00
Makefile
…
mbcache.c
mbcache: Avoid nesting of cache->c_list_lock under bit locks
2023-01-18 11:30:51 +01:00
mount.h
…
mpage.c
…
namei.c
mm: fs: initialize fsdata passed to write_begin/write_end interface
2022-11-25 17:40:29 +01:00
namespace.c
VFS: Fix memory leak caused by concurrently mounting fs with subtype
2022-05-15 19:41:59 +02:00
no-block.c
…
nsfs.c
dcache: sort the freeing-without-RCU-delay mess for good.
2019-05-25 18:23:26 +02:00
open.c
cifs_atomic_open(): fix double-put on late allocation failure
2020-03-18 07:14:21 +01:00
pipe.c
pipe: increase minimum default pipe size to 2 pages
2021-08-12 13:19:43 +02:00
pnode.c
pnode: terminate at peers of source
2023-01-18 11:30:40 +01:00
pnode.h
…
posix_acl.c
…
proc_namespace.c
…
read_write.c
vfs: avoid problematic remapping requests into partial EOF block
2019-12-01 09:17:04 +01:00
readdir.c
readdir: make sure to verify directory entry for legacy interfaces too
2021-04-28 13:16:50 +02:00
select.c
select: Fix indefinitely sleeping task in poll_schedule_timeout()
2022-01-29 10:19:18 +01:00
seq_file.c
seq_file: disallow extremely large seq buffer allocations
2021-07-20 16:16:16 +02:00
signalfd.c
signalfd: use wake_up_pollfree()
2021-12-14 10:18:07 +01:00
splice.c
Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
2022-10-26 13:19:21 +02:00
stack.c
…
stat.c
stat: fix inconsistency between struct stat and struct compat_stat
2022-04-27 13:39:44 +02:00
statfs.c
vfs: Fix EOVERFLOW testing in put_compat_statfs64
2019-10-11 18:21:39 +02:00
super.c
vfs: make freeze_super abort when sync_filesystem returns error
2022-02-23 11:58:38 +01:00
sync.c
…
timerfd.c
…
userfaultfd.c
userfaultfd: prevent concurrent API initialization
2021-09-22 11:48:02 +02:00
utimes.c
…
xattr.c
fs: don't audit the capability check in simple_xattr_list()
2023-01-18 11:30:04 +01:00