Matthew Wilcox (Oracle) 63b1898fff XArray: Disallow sibling entries of nodes
There is a race between xas_split() and xas_load() which can result in
the wrong page being returned, and thus data corruption.  Fortunately,
it's hard to hit (syzbot took three months to find it) and often guarded
with VM_BUG_ON().

The anatomy of this race is:

thread A			thread B
order-9 page is stored at index 0x200
				lookup of page at index 0x274
page split starts
				load of sibling entry at offset 9
stores nodes at offsets 8-15
				load of entry at offset 8

The entry at offset 8 turns out to be a node, and so we descend into it,
and load the page at index 0x234 instead of 0x274.  This is hard to fix
on the split side; we could replace the entire node that contains the
order-9 page instead of replacing the eight entries.  Fixing it on
the lookup side is easier; just disallow sibling entries that point
to nodes.  This cannot ever be a useful thing as the descent would not
know the correct offset to use within the new node.

The test suite continues to pass, but I have not added a new test for
this bug.

Reported-by: syzbot+cf4cf13056f85dec2c40@syzkaller.appspotmail.com
Tested-by: syzbot+cf4cf13056f85dec2c40@syzkaller.appspotmail.com
Fixes: 6b24ca4a1a8d ("mm: Use multi-index entries in the page cache")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
2022-04-22 15:35:40 -04:00
..
2021-07-08 11:48:20 -07:00
2022-03-23 12:56:39 -07:00
2020-08-09 14:10:26 -07:00
2021-09-08 11:50:26 -07:00
2022-03-03 10:47:52 +12:00
2021-07-08 11:48:20 -07:00
2021-07-08 11:48:20 -07:00
2021-11-18 13:16:22 -08:00
2021-05-06 19:24:12 -07:00
2018-08-16 12:14:42 -07:00
2021-01-21 14:06:00 -07:00
2022-03-07 12:48:35 -07:00
2021-08-19 09:02:55 +09:00
2021-01-03 20:05:18 -05:00
2022-01-15 08:47:31 -08:00
2022-03-07 12:48:35 -07:00
2020-10-20 14:39:37 -07:00
2021-08-19 09:02:55 +09:00
2022-03-24 18:07:03 -07:00
2021-07-08 11:48:20 -07:00
2022-01-20 08:52:53 +02:00
2021-07-08 11:48:20 -07:00
2022-03-26 12:19:04 -07:00
2018-10-16 13:45:44 +02:00
2021-07-08 11:48:20 -07:00
2021-07-08 11:48:20 -07:00
2021-08-08 13:00:20 +01:00
2021-09-17 13:52:17 +01:00
2021-07-08 11:48:20 -07:00
2021-07-08 11:48:20 -07:00
2021-07-08 11:48:20 -07:00
2022-02-25 09:36:06 +01:00
2021-06-18 11:43:09 +02:00
2021-07-08 11:48:20 -07:00
2022-01-20 08:52:54 +02:00
2018-10-15 16:31:29 -04:00