iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Lukas Czerner a2522041d2 ext4: block range must be validated before use in ext4_mb_clear_bb() 
[ Upstream commit 1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6 ]

Block range to free is validated in ext4_free_blocks() using
ext4_inode_block_valid() and then it's passed to ext4_mb_clear_bb().
However in some situations on bigalloc file system the range might be
adjusted after the validation in ext4_free_blocks() which can lead to
troubles on corrupted file systems such as one found by syzkaller that
resulted in the following BUG

kernel BUG at fs/ext4/ext4.h:3319!
PREEMPT SMP NOPTI
CPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014
RIP: 0010:ext4_free_blocks+0x95e/0xa90
Call Trace:
 <TASK>
 ? lock_timer_base+0x61/0x80
 ? __es_remove_extent+0x5a/0x760
 ? __mod_timer+0x256/0x380
 ? ext4_ind_truncate_ensure_credits+0x90/0x220
 ext4_clear_blocks+0x107/0x1b0
 ext4_free_data+0x15b/0x170
 ext4_ind_truncate+0x214/0x2c0
 ? _raw_spin_unlock+0x15/0x30
 ? ext4_discard_preallocations+0x15a/0x410
 ? ext4_journal_check_start+0xe/0x90
 ? __ext4_journal_start_sb+0x2f/0x110
 ext4_truncate+0x1b5/0x460
 ? __ext4_journal_start_sb+0x2f/0x110
 ext4_evict_inode+0x2b4/0x6f0
 evict+0xd0/0x1d0
 ext4_enable_quotas+0x11f/0x1f0
 ext4_orphan_cleanup+0x3de/0x430
 ? proc_create_seq_private+0x43/0x50
 ext4_fill_super+0x295f/0x3ae0
 ? snprintf+0x39/0x40
 ? sget_fc+0x19c/0x330
 ? ext4_reconfigure+0x850/0x850
 get_tree_bdev+0x16d/0x260
 vfs_get_tree+0x25/0xb0
 path_mount+0x431/0xa70
 __x64_sys_mount+0xe2/0x120
 do_syscall_64+0x5b/0x80
 ? do_user_addr_fault+0x1e2/0x670
 ? exc_page_fault+0x70/0x170
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fdf4e512ace

Fix it by making sure that the block range is properly validated before
used every time it changes in ext4_free_blocks() or ext4_mb_clear_bb().

Link: https://syzkaller.appspot.com/bug?id=5266d464285a03cee9dbfda7d2452a72c3c2ae7c
Reported-by: syzbot+15cd994e273307bf5cfa@syzkaller.appspotmail.com
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Cc: Tadeusz Struk <tadeusz.struk@linaro.org>
Tested-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Link: https://lore.kernel.org/r/20220714165903.58260-1-lczerner@redhat.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-08-25 11:45:47 +02:00
..
9p
9p: fix EBADF errors in cached mode
2022-06-17 06:03:30 +09:00
adfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
affs
affs: Convert affs to read_folio
2022-05-09 16:21:44 -04:00
afs
netfs: do not unlock and put the folio twice
2022-07-14 10:10:12 +02:00
autofs
…
befs
befs: Convert befs to read_folio
2022-05-09 16:21:45 -04:00
bfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
btrfs
btrfs: fix warning during log replay when bumping inode link count
2022-08-25 11:45:08 +02:00
cachefiles
cachefiles: narrow the scope of flushed requests when releasing fd
2022-07-05 16:12:21 +01:00
ceph
ceph: don't leak snap_rwsem in handle_cap_grant
2022-08-25 11:45:23 +02:00
cifs
cifs: Fix memory leak on the deferred close
2022-08-25 11:45:09 +02:00
coda
coda: Convert coda to read_folio
2022-05-09 16:21:45 -04:00
configfs
configfs: fix a race in configfs_{,un}register_subsystem()
2022-02-22 18:30:28 +01:00
cramfs
cramfs: Convert cramfs to read_folio
2022-05-09 16:21:45 -04:00
crypto
fscrypt: add new helper functions for test_dummy_encryption
2022-05-09 16:18:54 -07:00
debugfs
debugfs: Document that debugfs_create functions need not be error checked
2022-02-25 11:56:13 +01:00
devpts
fsnotify: fix fsnotify hooks in pseudo filesystems
2022-01-24 14:17:02 +01:00
dlm
dlm: use kref_put_lock in __put_lkb
2022-05-02 11:23:49 -05:00
ecryptfs
ecryptfs: Convert ecryptfs to read_folio
2022-05-09 16:21:45 -04:00
efivarfs
…
efs
efs: Convert efs symlinks to read_folio
2022-05-09 16:21:45 -04:00
erofs
erofs: update ctx->pos for every emitted dirent
2022-08-17 15:14:21 +02:00
exfat
exfat: use updated exfat_chain directly during renaming
2022-06-09 21:26:32 +09:00
exportfs
exportfs: support idmapped mounts
2022-04-28 16:31:10 +02:00
ext2
ext2: Add more validity checks for inode counts
2022-08-17 15:14:00 +02:00
ext4
ext4: block range must be validated before use in ext4_mb_clear_bb()
2022-08-25 11:45:47 +02:00
f2fs
f2fs: do not allow to decompress files have FI_COMPRESS_RELEASED
2022-08-17 15:16:02 +02:00
fat
Not a lot of material this cycle. Many singleton patches against various
2022-05-27 11:22:03 -07:00
freevxfs
SPDX changes for 5.19-rc1
2022-06-03 10:34:34 -07:00
fscache
fscache: don't leak cookie access refs if invalidation is in progress or failed
2022-08-25 11:45:25 +02:00
fuse
fuse: Remove the control interface for virtio-fs
2022-08-17 15:15:56 +02:00
gfs2
Page cache changes for 5.19
2022-05-24 19:55:07 -07:00
hfs
fs: Change try_to_free_buffers() to take a folio
2022-05-09 23:12:34 -04:00
hfsplus
fs: Change try_to_free_buffers() to take a folio
2022-05-09 23:12:34 -04:00
hostfs
hostfs: Convert hostfs to read_folio
2022-05-09 16:21:45 -04:00
hpfs
hpfs: Convert symlinks to read_folio
2022-05-09 16:21:45 -04:00
hugetlbfs
hugetlbfs: zero partial pages during fallocate hole punch
2022-06-16 19:11:32 -07:00
iomap
Page cache changes for 5.19
2022-05-24 19:55:07 -07:00
isofs
isofs: Convert symlinks and zisofs to read_folio
2022-05-09 16:21:45 -04:00
jbd2
jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
2022-08-17 15:15:43 +02:00
jffs2
This pull request contains fixes for JFFS2, UBI and UBIFS
2022-06-03 14:42:24 -07:00
jfs
JFS: One bug fix and some code cleanup
2022-05-27 15:59:21 -07:00
kernfs
kernfs: fix potential NULL dereference in __kernfs_remove
2022-08-17 15:15:26 +02:00
ksmbd
ksmbd: fix heap-based overflow in set_ntacl_dacl()
2022-08-17 15:13:54 +02:00
lockd
lockd: detect and reject lock arguments that overflow
2022-08-17 15:13:42 +02:00
minix
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
netfs
netfs: do not unlock and put the folio twice
2022-07-14 10:10:12 +02:00
nfs
NFSv4/pnfs: Fix a use-after-free bug in open
2022-08-25 11:45:12 +02:00
nfs_common
…
nfsd
nfsd: eliminate the NFSD_FILE_BREAK_* flags
2022-08-17 15:13:40 +02:00
nilfs2
nilfs2: fix incorrect masking of permission flags for symlinks
2022-07-03 15:42:33 -07:00
nls
…
notify
fanotify: refine the validation checks on non-dir inode mask
2022-06-28 11:18:13 +02:00
ntfs
ntfs: fix use-after-free in ntfs_ucsncmp()
2022-07-18 15:07:52 -07:00
ntfs3
fs/ntfs3: uninitialized variable in ntfs_set_acl_ex()
2022-08-25 11:45:30 +02:00
ocfs2
Revert "ocfs2: mount shared volume without ha stack"
2022-07-18 15:09:15 -07:00
omfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
openpromfs
fs: allocate inode by using alloc_inode_sb()
2022-03-22 15:57:03 -07:00
orangefs
orangefs: Convert to free_folio
2022-05-09 23:12:53 -04:00
overlayfs
ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh()
2022-08-17 15:13:48 +02:00
proc
proc: fix a dentry lock race between release_task and lookup
2022-08-17 15:15:54 +02:00
pstore
pstore: Don't use semaphores in always-atomic-context code
2022-03-15 11:08:23 -07:00
qnx4
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
qnx6
fs: Convert mpage_readpage to mpage_read_folio
2022-05-09 16:21:44 -04:00
quota
quota: Prevent memory allocation recursion while holding dq_lock
2022-06-06 10:08:10 +02:00
ramfs
Merge branch 'akpm' (patches from Andrew)
2021-11-09 10:11:53 -08:00
reiserfs
fs: Change try_to_free_buffers() to take a folio
2022-05-09 23:12:34 -04:00
romfs
romfs: Convert romfs to read_folio
2022-05-09 16:21:46 -04:00
smbfs_common
Add various fsctl structs
2022-05-23 20:24:12 -05:00
squashfs
Page cache changes for 5.19
2022-05-24 19:55:07 -07:00
sysfs
kobject: kobj_type: remove default_attrs
2022-04-05 15:39:19 +02:00
sysv
Not a lot of material this cycle. Many singleton patches against various
2022-05-27 11:22:03 -07:00
tracefs
tracefs: Fix syntax errors in comments
2022-06-17 19:01:28 -04:00
ubifs
This pull request contains fixes for JFFS2, UBI and UBIFS
2022-06-03 14:42:24 -07:00
udf
Page cache changes for 5.19
2022-05-24 19:55:07 -07:00
ufs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
unicode
kbuild: unify cmd_copy and cmd_shipped
2022-02-14 10:37:32 +09:00
vboxsf
vboxsf: Convert vboxsf to read_folio
2022-05-09 16:21:46 -04:00
verity
Page cache changes for 5.19
2022-05-24 19:55:07 -07:00
xfs
xfs: prevent a UAF when log IO errors race with unmount
2022-07-01 09:09:52 -07:00
zonefs
zonefs: fix zonefs_iomap_begin() for reads
2022-06-08 19:13:55 +09:00
aio.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2022-04-01 19:57:03 -07:00
anon_inodes.c
…
attr.c
vfs: Check the truncate maximum size in inode_newsize_ok()
2022-08-17 15:13:46 +02:00
bad_inode.c
…
binfmt_aout.c
…
binfmt_elf_fdpic.c
coredump: Snapshot the vmas in do_coredump
2022-03-08 12:55:29 -06:00
binfmt_elf_test.c
binfmt_elf: Introduce KUnit test
2022-03-03 20:38:56 -08:00
binfmt_elf.c
revert "fs/binfmt_elf: use PT_LOAD p_align values for static PIE"
2022-04-15 14:49:56 -07:00
binfmt_flat.c
binfmt_flat: Remove shared library support
2022-04-22 10:57:18 -07:00
binfmt_misc.c
Fix regression due to "fs: move binfmt_misc sysctl to its own file"
2022-02-09 09:50:02 -08:00
binfmt_script.c
…
buffer.c
fs: Convert drop_buffers() to use a folio
2022-05-09 23:12:34 -04:00
char_dev.c
…
compat_binfmt_elf.c
binfmt_elf: Introduce KUnit test
2022-03-03 20:38:56 -08:00
coredump.c
ptrace: Cleanups for v5.18
2022-03-28 17:29:53 -07:00
d_path.c
d_path: fix Kernel doc validator complaining
2021-11-06 13:30:32 -07:00
dax.c
libnvdimm for 5.19
2022-05-27 15:49:30 -07:00
dcache.c
mm: dcache: use kmem_cache_alloc_lru() to allocate dentry
2022-03-22 15:57:03 -07:00
direct-io.c
direct-io: remove random prefetches
2022-04-17 19:50:02 -06:00
drop_caches.c
…
eventfd.c
…
eventpoll.c
epoll: autoremove wakers even more aggressively
2022-08-17 15:13:59 +02:00
exec.c
posix-cpu-timers: Cleanup CPU timers before freeing them during exec
2022-08-17 15:16:06 +02:00
fcntl.c
VFS: add FMODE_CAN_ODIRECT file flag
2022-05-09 18:20:49 -07:00
fhandle.c
…
file_table.c
Descriptor handling cleanups
2022-06-04 18:52:00 -07:00
file.c
fix the breakage in close_fd_get_file() calling conventions change
2022-06-05 15:03:03 -04:00
filesystems.c
…
fs_context.c
vfs: fs_context: fix up param length parsing in legacy_parse_param
2022-01-18 09:23:19 +02:00
fs_parser.c
fs_parse: allow parameter value to be empty
2021-12-09 14:09:36 -05:00
fs_pin.c
…
fs_struct.c
…
fs_types.c
…
fs-writeback.c
writeback: Fix inode->i_io_list not be protected by inode->i_lock error
2022-06-06 09:54:30 +02:00
fsopen.c
uninline may_mount() and don't opencode it in fspick(2)/fsopen(2)
2022-05-19 23:25:10 -04:00
init.c
…
inode.c
writeback: Fix inode->i_io_list not be protected by inode->i_lock error
2022-06-06 09:54:30 +02:00
internal.h
Cleanups (and one fix) around struct mount handling.
2022-06-04 19:00:05 -07:00
ioctl.c
Fixes for 5.18-rc1:
2022-04-01 19:35:56 -07:00
Kconfig
mm: hugetlb_vmemmap: cleanup CONFIG_HUGETLB_PAGE_FREE_VMEMMAP*
2022-04-28 23:16:15 -07:00
Kconfig.binfmt
m68knommu: changes for linux 5.19
2022-05-30 10:56:18 -07:00
kernel_read_file.c
…
libfs.c
fs: Convert simple_readpage to simple_read_folio
2022-05-09 16:21:44 -04:00
locks.c
fs/lock: add 2 callbacks to lock_manager_operations to resolve conflict
2022-05-19 12:25:39 -04:00
Makefile
io_uring: move to separate directory
2022-08-17 15:14:20 +02:00
mbcache.c
mbcache: add functions to delete entry if unused
2022-08-17 15:13:56 +02:00
mount.h
…
mpage.c
fs: Change try_to_free_buffers() to take a folio
2022-05-09 23:12:34 -04:00
namei.c
__follow_mount_rcu(): verify that mount_lock remains unchanged
2022-08-17 15:16:06 +02:00
namespace.c
Cleanups (and one fix) around struct mount handling.
2022-06-04 19:00:05 -07:00
no-block.c
…
nsfs.c
…
open.c
RISC-V Patches for the 5.19 Merge Window, Part 1
2022-05-31 14:10:54 -07:00
pipe.c
Not a lot of material this cycle. Many singleton patches against various
2022-05-27 11:22:03 -07:00
pnode.c
…
pnode.h
…
posix_acl.c
fs: fix acl translation
2022-04-19 10:19:02 -07:00
proc_namespace.c
fs: add is_idmapped_mnt() helper
2021-12-03 18:44:06 +01:00
read_write.c
Thirteen hotfixes, Eight are cc:stable and the remainder are for post-5.18
2022-07-26 19:38:46 -07:00
readdir.c
…
remap_range.c
Revert "vf/remap: return the amount of bytes actually deduplicated"
2022-07-14 15:35:24 -07:00
select.c
select: Fix indefinitely sleeping task in poll_schedule_timeout()
2022-01-11 09:03:05 -08:00
seq_file.c
rxrpc: Fix locking issue
2022-05-22 21:03:01 +01:00
signalfd.c
Merge branch 'signal-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2022-01-17 05:49:30 +02:00
splice.c
fs: check FMODE_LSEEK to control internal pipe splicing
2022-08-17 15:14:49 +02:00
stack.c
…
stat.c
RISC-V Patches for the 5.19 Merge Window, Part 1
2022-05-31 14:10:54 -07:00
statfs.c
…
super.c
block: add a bdev_stable_writes helper
2022-04-17 19:49:59 -06:00
sync.c
riscv: compat: syscall: Add compat_sys_call_table implementation
2022-04-26 13:36:25 -07:00
sysctls.c
fs: move namespace sysctls and declare fs base directory
2022-01-22 08:33:36 +02:00
timerfd.c
…
userfaultfd.c
userfaultfd: provide properly masked address for huge-pages
2022-07-26 18:25:01 -07:00
utimes.c
…
xattr.c
fs: split off do_getxattr from getxattr
2022-04-24 18:18:37 -06:00