iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
yangerkun cf7b39a0cb block: reexpand iov_iter after read/write 
We get a bug:

BUG: KASAN: slab-out-of-bounds in iov_iter_revert+0x11c/0x404
lib/iov_iter.c:1139
Read of size 8 at addr ffff0000d3fb11f8 by task

CPU: 0 PID: 12582 Comm: syz-executor.2 Not tainted
5.10.0-00843-g352c8610ccd2 #2
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x0/0x2d0 arch/arm64/kernel/stacktrace.c:132
 show_stack+0x28/0x34 arch/arm64/kernel/stacktrace.c:196
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x110/0x164 lib/dump_stack.c:118
 print_address_description+0x78/0x5c8 mm/kasan/report.c:385
 __kasan_report mm/kasan/report.c:545 [inline]
 kasan_report+0x148/0x1e4 mm/kasan/report.c:562
 check_memory_region_inline mm/kasan/generic.c:183 [inline]
 __asan_load8+0xb4/0xbc mm/kasan/generic.c:252
 iov_iter_revert+0x11c/0x404 lib/iov_iter.c:1139
 io_read fs/io_uring.c:3421 [inline]
 io_issue_sqe+0x2344/0x2d64 fs/io_uring.c:5943
 __io_queue_sqe+0x19c/0x520 fs/io_uring.c:6260
 io_queue_sqe+0x2a4/0x590 fs/io_uring.c:6326
 io_submit_sqe fs/io_uring.c:6395 [inline]
 io_submit_sqes+0x4c0/0xa04 fs/io_uring.c:6624
 __do_sys_io_uring_enter fs/io_uring.c:9013 [inline]
 __se_sys_io_uring_enter fs/io_uring.c:8960 [inline]
 __arm64_sys_io_uring_enter+0x190/0x708 fs/io_uring.c:8960
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]
 do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:227
 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367
 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383
 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670

Allocated by task 12570:
 stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121
 kasan_save_stack mm/kasan/common.c:48 [inline]
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc+0xdc/0x120 mm/kasan/common.c:461
 kasan_kmalloc+0xc/0x14 mm/kasan/common.c:475
 __kmalloc+0x23c/0x334 mm/slub.c:3970
 kmalloc include/linux/slab.h:557 [inline]
 __io_alloc_async_data+0x68/0x9c fs/io_uring.c:3210
 io_setup_async_rw fs/io_uring.c:3229 [inline]
 io_read fs/io_uring.c:3436 [inline]
 io_issue_sqe+0x2954/0x2d64 fs/io_uring.c:5943
 __io_queue_sqe+0x19c/0x520 fs/io_uring.c:6260
 io_queue_sqe+0x2a4/0x590 fs/io_uring.c:6326
 io_submit_sqe fs/io_uring.c:6395 [inline]
 io_submit_sqes+0x4c0/0xa04 fs/io_uring.c:6624
 __do_sys_io_uring_enter fs/io_uring.c:9013 [inline]
 __se_sys_io_uring_enter fs/io_uring.c:8960 [inline]
 __arm64_sys_io_uring_enter+0x190/0x708 fs/io_uring.c:8960
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common arch/arm64/kernel/syscall.c:158 [inline]
 do_el0_svc+0x120/0x290 arch/arm64/kernel/syscall.c:227
 el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:367
 el0_sync_handler+0x98/0x170 arch/arm64/kernel/entry-common.c:383
 el0_sync+0x140/0x180 arch/arm64/kernel/entry.S:670

Freed by task 12570:
 stack_trace_save+0x80/0xb8 kernel/stacktrace.c:121
 kasan_save_stack mm/kasan/common.c:48 [inline]
 kasan_set_track+0x38/0x6c mm/kasan/common.c:56
 kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:355
 __kasan_slab_free+0x124/0x150 mm/kasan/common.c:422
 kasan_slab_free+0x10/0x1c mm/kasan/common.c:431
 slab_free_hook mm/slub.c:1544 [inline]
 slab_free_freelist_hook mm/slub.c:1577 [inline]
 slab_free mm/slub.c:3142 [inline]
 kfree+0x104/0x38c mm/slub.c:4124
 io_dismantle_req fs/io_uring.c:1855 [inline]
 __io_free_req+0x70/0x254 fs/io_uring.c:1867
 io_put_req_find_next fs/io_uring.c:2173 [inline]
 __io_queue_sqe+0x1fc/0x520 fs/io_uring.c:6279
 __io_req_task_submit+0x154/0x21c fs/io_uring.c:2051
 io_req_task_submit+0x2c/0x44 fs/io_uring.c:2063
 task_work_run+0xdc/0x128 kernel/task_work.c:151
 get_signal+0x6f8/0x980 kernel/signal.c:2562
 do_signal+0x108/0x3a4 arch/arm64/kernel/signal.c:658
 do_notify_resume+0xbc/0x25c arch/arm64/kernel/signal.c:722
 work_pending+0xc/0x180

blkdev_read_iter can truncate iov_iter's count since the count + pos may
exceed the size of the blkdev. This will confuse io_read that we have
consume the iovec. And once we do the iov_iter_revert in io_read, we
will trigger the slab-out-of-bounds. Fix it by reexpand the count with
size has been truncated.

blkdev_write_iter can trigger the problem too.

Signed-off-by: yangerkun <yangerkun@huawei.com>
Acked-by: Pavel Begunkov <asml.silencec@gmail.com>
Link: https://lore.kernel.org/r/20210401071807.3328235-1-yangerkun@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2021-05-06 09:24:03 -06:00
..
9p
9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"
2021-03-12 22:15:22 -05:00
adfs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
affs
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
afs
AFS: Use the new netfs lib
2021-04-27 13:27:39 -07:00
autofs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
befs
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
bfs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
btrfs
Merge branch 'miklos.fileattr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-04-27 11:18:24 -07:00
cachefiles
fscache, cachefiles: Add alternate API to use kiocb for read/write to cache
2021-04-23 10:14:32 +01:00
ceph
ceph: don't allow type or device number to change on non-I_NEW inodes
2021-03-08 10:19:37 -05:00
cifs
Merge branch 'work.inode-type-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-04-27 10:57:42 -07:00
coda
coda: fix reference counting in coda_file_mmap error path
2021-04-23 14:42:39 -07:00
configfs
configfs: fix a use-after-free in __configfs_open_file
2021-03-11 12:13:48 +01:00
cramfs
cramfs: use %pD instead of messing with file_dentry()->d_name
2021-01-05 23:02:47 -05:00
crypto
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2021-04-26 08:51:23 -07:00
debugfs
Scheduler updates for this cycle are:
2021-04-28 13:33:57 -07:00
devpts
…
dlm
fs: dlm: check on existing node address
2020-11-10 12:14:20 -06:00
ecryptfs
ecryptfs: stack fileattr ops
2021-04-12 15:04:29 +02:00
efivarfs
efivars: convert to fileattr
2021-04-12 15:04:29 +02:00
efs
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
erofs
erofs: enable big pcluster feature
2021-04-10 03:20:19 +08:00
exfat
exfat: speed up iterate/lookup by fixing start point of traversing cluster chain
2021-04-27 20:45:07 +09:00
exportfs
exportfs: Add a function to return the raw output from fh_to_dentry()
2020-12-09 09:39:38 -05:00
ext2
\n
2021-04-29 11:06:13 -07:00
ext4
\n
2021-04-29 11:06:13 -07:00
f2fs
Network filesystem helper library
2021-04-27 13:08:12 -07:00
fat
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
freevxfs
…
fscache
fscache, cachefiles: Add alternate API to use kiocb for read/write to cache
2021-04-23 10:14:32 +01:00
fuse
Merge branch 'miklos.fileattr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-04-27 11:18:24 -07:00
gfs2
Changes in gfs2:
2021-04-29 10:33:35 -07:00
hfs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
hfsplus
hfsplus: convert to fileattr
2021-04-12 15:04:29 +02:00
hostfs
Merge branch 'work.inode-type-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-04-27 10:57:42 -07:00
hpfs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
hugetlbfs
hugetlbfs: remove unneeded return value of hugetlb_vmtruncate()
2021-02-24 13:38:35 -08:00
iomap
New code for 5.13:
2021-04-27 12:27:23 -07:00
isofs
isofs: handle large user and group ID
2021-02-03 19:05:52 +01:00
jbd2
block: use an on-stack bio in blkdev_issue_flush
2021-01-27 09:51:48 -07:00
jffs2
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
jfs
jfs: convert to fileattr
2021-04-12 15:04:29 +02:00
kernfs
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
lockd
SUNRPC: Make trace_svc_process() display the RPC procedure symbolically
2021-01-25 09:36:23 -05:00
minix
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
netfs
netfs: Miscellaneous fixes
2021-04-26 23:23:41 +01:00
nfs
selinux/stable-5.13 PR 20210426
2021-04-27 13:42:11 -07:00
nfs_common
NFSD: Add an xdr_stream-based encoder for NFSv2/3 ACLs
2021-03-22 10:19:00 -04:00
nfsd
Merge branch 'work.inode-type-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-04-27 10:57:42 -07:00
nilfs2
nilfs2: convert to fileattr
2021-04-12 15:04:30 +02:00
nls
…
notify
fanotify_user: use upper_32_bits() to verify mask
2021-03-25 15:33:45 +01:00
ntfs
ntfs: check for valid standard information attribute
2021-02-24 13:38:26 -08:00
ocfs2
Merge branch 'miklos.fileattr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-04-27 11:18:24 -07:00
omfs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
openpromfs
openpromfs: don't do unlock_new_inode() until the new inode is set up
2021-03-12 22:15:22 -05:00
orangefs
Merge branch 'miklos.fileattr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-04-27 11:18:24 -07:00
overlayfs
Merge branch 'miklos.fileattr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-04-27 11:18:24 -07:00
proc
seccomp updates for v5.13-rc1
2021-04-27 10:03:12 -07:00
pstore
printk changes for 5.13
2021-04-27 18:09:44 -07:00
qnx4
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
qnx6
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
quota
quota: report warning limits for realtime space quotas
2021-03-18 17:03:54 +01:00
ramfs
ramfs: support O_TMPFILE
2021-02-24 13:38:26 -08:00
reiserfs
\n
2021-04-29 10:51:29 -07:00
romfs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
squashfs
squashfs: fix xattr id and id lookup sanity checks
2021-03-25 09:22:55 -07:00
sysfs
sysfs: Support zapping of binary attr mmaps
2021-01-12 14:26:31 +01:00
sysv
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
tracefs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
ubifs
Merge branch 'miklos.fileattr' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-04-27 11:18:24 -07:00
udf
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
ufs
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
unicode
…
vboxsf
vboxsf: don't allow to change the inode type
2021-03-12 22:15:00 -05:00
verity
fsverity: relax build time dependency on CRYPTO_SHA256
2021-04-22 17:31:32 +10:00
xfs
New code for 5.13:
2021-04-29 10:43:51 -07:00
zonefs
\n
2021-04-29 11:06:13 -07:00
aio.c
Merge branch 'akpm' (patches from Andrew)
2020-12-15 12:53:37 -08:00
anon_inodes.c
fs: anon_inodes: rephrase to appropriate kernel-doc
2021-01-15 12:17:25 -05:00
attr.c
ima: handle idmapped mounts
2021-01-24 14:27:20 +01:00
bad_inode.c
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
binfmt_aout.c
…
binfmt_elf_fdpic.c
coredump: don't bother with do_truncate()
2021-03-08 10:21:11 -05:00
binfmt_elf.c
coredump: don't bother with do_truncate()
2021-03-08 10:21:11 -05:00
binfmt_em86.c
…
binfmt_flat.c
…
binfmt_misc.c
binfmt_misc: fix possible deadlock in bm_register_write
2021-03-13 11:27:30 -08:00
binfmt_script.c
…
block_dev.c
block: reexpand iov_iter after read/write
2021-05-06 09:24:03 -06:00
buffer.c
fs: buffer: use raw page_memcg() on locked page
2021-02-24 13:38:30 -08:00
char_dev.c
…
compat_binfmt_elf.c
get rid of COMPAT_ELF_EXEC_PAGESIZE
2021-01-06 08:42:51 -05:00
coredump.c
coredump: don't bother with do_truncate()
2021-03-08 10:21:11 -05:00
d_path.c
fs: fix NULL dereference due to data race in prepend_path()
2020-10-14 14:54:45 -07:00
dax.c
mm: provide a saner PTE walking API for modules
2021-02-09 07:05:44 -05:00
dcache.c
fs: delete repeated words in comments
2021-02-24 13:38:26 -08:00
direct-io.c
fs: direct-io: fix missing sdio->boundary
2021-04-09 14:54:23 -07:00
drop_caches.c
…
eventfd.c
eventfd: Export eventfd_ctx_do_read()
2020-11-15 09:49:10 -05:00
eventpoll.c
fs: eventpoll: fix comments & kernel-doc notation
2021-03-06 17:36:53 -07:00
exec.c
fs: delete repeated words in comments
2021-02-24 13:38:26 -08:00
fcntl.c
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
fhandle.c
fs: delete repeated words in comments
2021-02-24 13:38:26 -08:00
file_table.c
epoll: take epitem list out of struct file
2020-10-25 20:02:08 -04:00
file.c
file: fix close_range() for unshare+cloexec
2021-04-02 14:11:10 +02:00
filesystems.c
…
fs_context.c
…
fs_parser.c
fs_parse: mark fs_param_bad_value() as static
2020-10-13 18:38:27 -07:00
fs_pin.c
…
fs_struct.c
…
fs_types.c
…
fs-writeback.c
fs: improve comments for writeback_single_inode()
2021-01-13 17:26:50 +01:00
fsopen.c
…
init.c
init: handle idmapped mounts
2021-01-24 14:27:19 +01:00
inode.c
fs.idmapped.helpers.v5.13
2021-04-27 12:49:42 -07:00
internal.h
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
io_uring.c
for-5.13/io_uring-2021-04-27
2021-04-28 14:56:09 -07:00
io-wq.c
io-wq: remove unused io_wqe_need_worker() function
2021-04-20 11:24:22 -06:00
io-wq.h
io-wq: eliminate the need for a manager thread
2021-04-11 17:42:00 -06:00
ioctl.c
vfs: add fileattr ops
2021-04-12 15:04:23 +02:00
Kconfig
netfs: Provide readahead and readpage netfs helpers
2021-04-23 10:14:32 +01:00
Kconfig.binfmt
Merge branch 'work.elf-compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2021-02-21 09:29:23 -08:00
kernel_read_file.c
fs/kernel_file_read: Add "offset" arg for partial reads
2020-10-05 13:37:04 +02:00
libfs.c
libfs: fix kernel-doc for mnt_userns
2021-03-23 11:20:25 +01:00
locks.c
File locking fixes for v5.13
2021-04-26 13:24:39 -07:00
Makefile
netfs: Provide readahead and readpage netfs helpers
2021-04-23 10:14:32 +01:00
mbcache.c
…
mount.h
mount: make {lock,unlock}_mount_hash() static
2021-01-24 14:29:34 +01:00
mpage.c
block: rename BIO_MAX_PAGES to BIO_MAX_VECS
2021-03-11 07:47:48 -07:00
namei.c
fs.idmapped.helpers.v5.13
2021-04-27 12:49:42 -07:00
namespace.c
fs/namespace: correct/improve kernel-doc notation
2021-03-31 14:22:55 -06:00
no-block.c
…
nsfs.c
…
open.c
idmapped-mounts-v5.12
2021-02-23 13:39:45 -08:00
pipe.c
fs: delete repeated words in comments
2021-02-24 13:38:26 -08:00
pnode.c
…
pnode.h
mount: fix mounting of detached mounts onto targets that reside on shared mounts
2021-03-08 15:18:43 +01:00
posix_acl.c
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
proc_namespace.c
fs: introduce MOUNT_ATTR_IDMAP
2021-01-24 14:43:45 +01:00
read_write.c
teach sendfile(2) to handle send-to-pipe directly
2021-01-25 23:29:36 -05:00
readdir.c
readdir: make sure to verify directory entry for legacy interfaces too
2021-04-17 11:39:49 -07:00
remap_range.c
ioctl: handle idmapped mounts
2021-01-24 14:27:19 +01:00
select.c
kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()
2021-03-16 22:13:10 +01:00
seq_file.c
fs: fix kernel-doc markups
2021-01-21 14:06:00 -07:00
signalfd.c
signal: Introduce TRAP_PERF si_code and si_perf to siginfo
2021-04-16 16:32:41 +02:00
splice.c
for-5.12/block-2021-02-17
2021-02-21 11:02:48 -08:00
stack.c
…
stat.c
fs: make helpers idmap mount aware
2021-01-24 14:27:20 +01:00
statfs.c
s390,alpha: switch to 64-bit ino_t
2021-02-13 17:17:53 +01:00
super.c
It has been a relatively quiet cycle in docsland.
2021-02-22 10:57:46 -08:00
sync.c
…
timerfd.c
…
userfaultfd.c
userfaultfd: use secure anon inodes for userfaultfd
2021-01-14 17:40:57 -05:00
utimes.c
utimes: handle idmapped mounts
2021-01-24 14:27:18 +01:00
xattr.c
xattr: fix kernel-doc for mnt_userns and vfs xattr helpers
2021-03-23 11:20:26 +01:00