Zhihao Cheng
fcfeecca15
quota: Check next/prev free block number after reading from quota file ...
commit 6c8ea8b8cd4722efd419f91ca46a2dc81b7d89a3 upstream.
Following process:
Init: v2_read_file_info: <3> dqi_free_blk 0 dqi_free_entry 5 dqi_blks 6
Step 1. chown bin f_a -> dquot_acquire -> v2_write_dquot:
qtree_write_dquot
do_insert_tree
find_free_dqentry
get_free_dqblk
write_blk(info->dqi_blocks) // info->dqi_blocks = 6, failure. The
content in physical block (corresponding to blk 6) is random.
Step 2. chown root f_a -> dquot_transfer -> dqput_all -> dqput ->
ext4_release_dquot -> v2_release_dquot -> qtree_delete_dquot:
dquot_release
remove_tree
free_dqentry
put_free_dqblk(6)
info->dqi_free_blk = blk // info->dqi_free_blk = 6
Step 3. drop cache (buffer head for block 6 is released)
Step 4. chown bin f_b -> dquot_acquire -> commit_dqblk -> v2_write_dquot:
qtree_write_dquot
do_insert_tree
find_free_dqentry
get_free_dqblk
dh = (struct qt_disk_dqdbheader *)buf
blk = info->dqi_free_blk // 6
ret = read_blk(info, blk, buf) // The content of buf is random
info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free) // random blk
Step 5. chown bin f_c -> notify_change -> ext4_setattr -> dquot_transfer:
dquot = dqget -> acquire_dquot -> ext4_acquire_dquot -> dquot_acquire ->
commit_dqblk -> v2_write_dquot -> dq_insert_tree:
do_insert_tree
find_free_dqentry
get_free_dqblk
blk = info->dqi_free_blk // If blk < 0 and blk is not an error
code, it will be returned as dquot
transfer_to[USRQUOTA] = dquot // A random negative value
__dquot_transfer(transfer_to)
dquot_add_inodes(transfer_to[cnt])
spin_lock(&dquot->dq_dqb_lock) // page fault
, which will lead to kernel page fault:
Quota error (device sda): qtree_write_dquot: Error -8000 occurred
while creating quota
BUG: unable to handle page fault for address: ffffffffffffe120
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
Oops: 0002 [#1 ] PREEMPT SMP
CPU: 0 PID: 5974 Comm: chown Not tainted 6.0.0-rc1-00004
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:_raw_spin_lock+0x3a/0x90
Call Trace:
dquot_add_inodes+0x28/0x270
__dquot_transfer+0x377/0x840
dquot_transfer+0xde/0x540
ext4_setattr+0x405/0x14d0
notify_change+0x68e/0x9f0
chown_common+0x300/0x430
__x64_sys_fchownat+0x29/0x40
In order to avoid accessing invalid quota memory address, this patch adds
block number checking of next/prev free block read from quota file.
Fetch a reproducer in [Link].
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216372
Fixes: 1da177e4c3f4152 ("Linux-2.6.12-rc2")
CC: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20220923134555.2623931-2-chengzhihao1@huawei.com
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-26 12:34:21 +02:00
2022-08-17 14:24:07 +02:00
2022-09-23 14:15:51 +02:00
2021-10-20 21:09:02 -04:00
2021-08-19 09:02:55 +09:00
2022-09-28 11:11:42 +02:00
2022-07-02 16:41:14 +02:00
2022-10-15 07:59:01 +02:00
2022-10-26 12:34:19 +02:00
2022-03-02 11:48:02 +01:00
2021-11-18 19:16:11 +01:00
2022-09-15 11:30:02 +02:00
2022-02-01 17:27:01 +01:00
2022-10-26 12:34:20 +02:00
2022-07-02 16:41:14 +02:00
2022-09-15 11:30:06 +02:00
2022-07-29 17:25:30 +02:00
2022-06-09 10:23:32 +02:00
2022-08-17 14:23:00 +02:00
2022-09-28 11:11:58 +02:00
2022-08-25 11:40:45 +02:00
2022-06-09 10:22:42 +02:00
2021-10-04 22:13:12 +01:00
2022-08-17 14:24:11 +02:00
2022-07-12 16:34:59 +02:00
2021-08-26 22:28:02 +02:00
2022-06-09 10:23:11 +02:00
2022-06-09 10:22:55 +02:00
2021-11-12 15:05:50 +01:00
2022-08-17 14:24:01 +02:00
2022-06-14 18:36:10 +02:00
2022-06-09 10:22:41 +02:00
2022-06-14 18:36:22 +02:00
2022-09-05 10:30:11 +02:00
2022-08-17 14:22:47 +02:00
2022-04-13 20:59:10 +02:00
2021-12-29 12:28:59 +01:00
2022-09-28 11:11:57 +02:00
2021-10-04 22:02:17 +01:00
2022-08-17 14:22:45 +02:00
2022-10-15 07:59:01 +02:00
2022-06-09 10:22:50 +02:00
2022-10-05 10:39:37 +02:00
2022-09-05 10:30:10 +02:00
2022-08-03 12:03:41 +02:00
2022-01-20 09:13:13 +01:00
2022-08-25 11:40:43 +02:00
2022-08-31 17:16:37 +02:00
2022-04-08 14:23:01 +02:00
2021-09-21 08:36:48 -07:00
2022-10-26 12:34:21 +02:00
2021-09-03 15:33:47 -07:00
2021-12-14 10:57:12 +01:00
2021-08-16 10:50:32 -06:00
2021-08-06 13:05:28 +02:00
2022-09-20 12:39:43 +02:00
2022-04-08 14:24:08 +02:00
2022-05-15 20:18:52 +02:00
2021-08-19 09:02:55 +09:00
2021-09-27 11:26:21 -07:00
2021-09-22 10:56:34 -07:00
2022-09-28 11:11:45 +02:00
2022-08-31 17:16:34 +02:00
2021-12-14 10:57:22 +01:00
2022-08-17 14:22:50 +02:00
2021-08-18 22:08:24 +02:00
2021-09-05 10:15:05 -07:00
2022-04-08 14:24:17 +02:00
2022-04-08 14:24:18 +02:00
2022-06-09 10:22:26 +02:00
2022-04-08 14:22:54 +02:00
2022-04-08 14:24:18 +02:00
2021-09-02 10:07:29 -07:00
2022-09-28 11:11:56 +02:00
2021-09-03 09:58:10 -07:00
2021-09-06 07:20:56 -04:00
2022-08-17 14:22:59 +02:00
2022-08-17 14:24:19 +02:00
2021-09-03 10:08:28 -07:00
2022-05-18 10:26:57 +02:00
2022-04-08 14:23:54 +02:00
2021-08-23 01:25:40 -04:00
2022-01-20 09:13:14 +01:00
2021-09-07 16:07:47 -04:00
2022-08-31 17:16:47 +02:00
2022-10-12 09:53:26 +02:00
2022-10-05 10:39:44 +02:00
2022-10-26 12:34:18 +02:00
2021-12-22 09:32:51 +01:00
2021-08-29 07:55:55 -06:00
2022-05-25 09:57:26 +02:00
2021-09-12 10:10:21 -07:00
2021-10-18 20:22:03 -10:00
2021-09-07 11:21:48 -07:00
2021-09-12 10:10:21 -07:00
2022-08-17 14:22:57 +02:00
2022-08-17 14:24:19 +02:00
2022-08-31 17:16:37 +02:00
2022-07-02 16:41:17 +02:00
2022-06-06 08:43:37 +02:00
2022-07-02 16:41:17 +02:00
2022-07-02 16:41:14 +02:00
2022-08-03 12:03:41 +02:00
2022-07-21 21:24:14 +02:00
2022-01-29 10:58:25 +01:00
2022-07-12 16:35:08 +02:00
2021-12-14 10:57:15 +01:00
2022-10-26 12:34:17 +02:00
2022-04-27 14:38:57 +02:00
2022-02-23 12:03:05 +01:00
2022-04-27 14:38:50 +02:00
2021-08-10 17:57:22 +02:00
2021-10-18 20:22:02 -10:00
2022-10-05 10:39:44 +02:00
fcfeecca15