iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Chao Yu c6ad7fd166 f2fs: fix to do sanity check on summary info 
As Wenqing Liu reported in bugzilla:

https://bugzilla.kernel.org/show_bug.cgi?id=216456

BUG: KASAN: use-after-free in recover_data+0x63ae/0x6ae0 [f2fs]
Read of size 4 at addr ffff8881464dcd80 by task mount/1013

CPU: 3 PID: 1013 Comm: mount Tainted: G        W          6.0.0-rc4 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
Call Trace:
 dump_stack_lvl+0x45/0x5e
 print_report.cold+0xf3/0x68d
 kasan_report+0xa8/0x130
 recover_data+0x63ae/0x6ae0 [f2fs]
 f2fs_recover_fsync_data+0x120d/0x1fc0 [f2fs]
 f2fs_fill_super+0x4665/0x61e0 [f2fs]
 mount_bdev+0x2cf/0x3b0
 legacy_get_tree+0xed/0x1d0
 vfs_get_tree+0x81/0x2b0
 path_mount+0x47e/0x19d0
 do_mount+0xce/0xf0
 __x64_sys_mount+0x12c/0x1a0
 do_syscall_64+0x38/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The root cause is: in fuzzed image, SSA table is corrupted: ofs_in_node
is larger than ADDRS_PER_PAGE(), result in out-of-range access on 4k-size
page.

- recover_data
 - do_recover_data
  - check_index_in_prev_nodes
   - f2fs_data_blkaddr

This patch adds sanity check on summary info in recovery and GC flow
in where the flows rely on them.

After patch:
[   29.310883] F2FS-fs (loop0): Inconsistent ofs_in_node:65286 in summary, ino:0, nid:6, max:1018

Cc: stable@vger.kernel.org
Reported-by: Wenqing Liu <wenqingliu0120@gmail.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2022-10-04 13:31:43 -07:00
..
9p
9p: Fix some kernel-doc comments
2022-07-02 18:52:21 +09:00
adfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
affs
affs: use memcpy_to_page and remove replace kmap_atomic()
2022-08-01 19:53:31 +02:00
afs
afs: Enable multipage folio support
2022-08-13 17:20:51 -07:00
autofs
autofs: remove unused ino field inode
2022-07-17 17:31:42 -07:00
befs
befs: Convert befs_symlink_read_folio() to use a folio
2022-08-02 12:34:03 -04:00
bfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
btrfs
for-6.0-rc3-tag
2022-08-28 10:44:04 -07:00
cachefiles
cachefiles: narrow the scope of flushed requests when releasing fd
2022-07-05 16:12:21 +01:00
ceph
We have a good pile of various fixes and cleanups from Xiubo, Jeff,
2022-08-11 12:41:07 -07:00
cifs
cifs: Add helper function to check smb1+ server
2022-08-24 22:30:09 -05:00
coda
coda: Convert coda_symlink_filler() to use a folio
2022-08-02 12:34:03 -04:00
configfs
configfs: fix a race in configfs_{,un}register_subsystem()
2022-02-22 18:30:28 +01:00
cramfs
cramfs: read_mapping_page() is synchronous
2022-08-02 12:34:02 -04:00
crypto
We have a good pile of various fixes and cleanups from Xiubo, Jeff,
2022-08-11 12:41:07 -07:00
debugfs
debugfs: Document that debugfs_create functions need not be error checked
2022-02-25 11:56:13 +01:00
devpts
fsnotify: fix fsnotify hooks in pseudo filesystems
2022-01-24 14:17:02 +01:00
dlm
fs: dlm: move kref_put assert for lkb structs
2022-08-01 09:31:46 -05:00
ecryptfs
ecryptfs: Convert ecryptfs to read_folio
2022-05-09 16:21:45 -04:00
efivarfs
efi: vars: Move efivar caching layer into efivarfs
2022-06-24 20:40:19 +02:00
efs
efs: Convert efs symlinks to read_folio
2022-05-09 16:21:45 -04:00
erofs
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
exfat
exfat: Drop superfluous new line for error messages
2022-08-01 10:14:07 +09:00
exportfs
exportfs: support idmapped mounts
2022-04-28 16:31:10 +02:00
ext2
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
ext4
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
f2fs
f2fs: fix to do sanity check on summary info
2022-10-04 13:31:43 -07:00
fat
Updates to various subsystems which I help look after. lib, ocfs2,
2022-08-07 10:03:24 -07:00
freevxfs
freevxfs: Convert vxfs_immed_read_folio() to use a folio
2022-08-02 12:34:03 -04:00
fscache
fscache: add tracepoint when failing cookie
2022-08-09 14:13:59 +01:00
fuse
iov_iter stuff, part 2, rebased
2022-08-08 20:04:35 -07:00
gfs2
New code for 6.0:
2022-08-11 13:11:49 -07:00
hfs
hfs: Remove check for PageError
2022-06-29 08:51:06 -04:00
hfsplus
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
hostfs
hostfs: Handle page write errors correctly
2022-08-02 12:34:02 -04:00
hpfs
hpfs: Convert symlinks to read_folio
2022-05-09 16:21:45 -04:00
hugetlbfs
iov_iter stuff, part 2, rebased
2022-08-08 20:04:35 -07:00
iomap
New code for 6.0:
2022-08-11 13:11:49 -07:00
isofs
fs/buffer: Combine two submit_bh() and ll_rw_block() arguments
2022-07-14 12:14:32 -06:00
jbd2
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
jffs2
This pull request contains fixes for JFFS2, UBI and UBIFS
2022-06-03 14:42:24 -07:00
jfs
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
kernfs
kernfs: Fix typo 'the the' in comment
2022-07-28 10:57:25 +02:00
ksmbd
ksmbd: don't remove dos attribute xattr on O_TRUNC open
2022-08-15 21:07:01 -05:00
lockd
lockd: detect and reject lock arguments that overflow
2022-08-04 10:28:48 -04:00
minix
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
netfs
netfs: do not unlock and put the folio twice
2022-07-14 10:10:12 +02:00
nfs
NFS client bugfixes for Linux 6.0
2022-08-22 11:40:01 -07:00
nfs_common
…
nfsd
NFSD 6.0 Release Notes
2022-08-09 14:56:49 -07:00
nilfs2
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
nls
…
notify
fsnotify: Fix comment typo
2022-07-26 13:38:47 +02:00
ntfs
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
ntfs3
fs.idmapped.fixes.v6.0-rc3
2022-08-22 11:33:02 -07:00
ocfs2
ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown
2022-08-28 14:02:45 -07:00
omfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
openpromfs
fs: allocate inode by using alloc_inode_sb()
2022-03-22 15:57:03 -07:00
orangefs
orangefs: Remove test for folio error
2022-06-29 08:51:07 -04:00
overlayfs
acl: handle idmapped mounts for idmapped filesystems
2022-08-17 11:23:31 +02:00
proc
mm/smaps: don't access young/dirty bit if pte unpresent
2022-08-20 15:17:45 -07:00
pstore
EFI updates for v5.20
2022-08-03 14:38:02 -07:00
qnx4
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
qnx6
fs: Convert mpage_readpage to mpage_read_folio
2022-05-09 16:21:44 -04:00
quota
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
ramfs
…
reiserfs
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
romfs
romfs: Convert romfs to read_folio
2022-05-09 16:21:46 -04:00
smbfs_common
Add various fsctl structs
2022-05-23 20:24:12 -05:00
squashfs
squashfs: don't call kmalloc in decompressors
2022-08-28 14:02:45 -07:00
sysfs
kobject: kobj_type: remove default_attrs
2022-04-05 15:39:19 +02:00
sysv
Not a lot of material this cycle. Many singleton patches against various
2022-05-27 11:22:03 -07:00
tracefs
tracefs: Fix syntax errors in comments
2022-06-17 19:01:28 -04:00
ubifs
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
udf
fs/buffer: Combine two submit_bh() and ll_rw_block() arguments
2022-07-14 12:14:32 -06:00
ufs
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
unicode
kbuild: unify cmd_copy and cmd_shipped
2022-02-14 10:37:32 +09:00
vboxsf
vboxsf: Convert vboxsf to read_folio
2022-05-09 16:21:46 -04:00
verity
fs-verity: mention btrfs support
2022-07-15 23:42:30 -07:00
xfs
New code for 6.0:
2022-08-13 13:50:11 -07:00
zonefs
New code for 6.0:
2022-08-11 13:11:49 -07:00
aio.c
iov_iter work, part 1 - isolated cleanups and optimizations.
2022-08-03 13:50:22 -07:00
anon_inodes.c
…
attr.c
vfs: Check the truncate maximum size in inode_newsize_ok()
2022-08-08 10:39:29 -07:00
bad_inode.c
…
binfmt_aout.c
…
binfmt_elf_fdpic.c
coredump: Snapshot the vmas in do_coredump
2022-03-08 12:55:29 -06:00
binfmt_elf_test.c
binfmt_elf: Introduce KUnit test
2022-03-03 20:38:56 -08:00
binfmt_elf.c
revert "fs/binfmt_elf: use PT_LOAD p_align values for static PIE"
2022-04-15 14:49:56 -07:00
binfmt_flat.c
binfmt_flat: Remove shared library support
2022-04-22 10:57:18 -07:00
binfmt_misc.c
Fix regression due to "fs: move binfmt_misc sysctl to its own file"
2022-02-09 09:50:02 -08:00
binfmt_script.c
…
buffer.c
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
char_dev.c
…
compat_binfmt_elf.c
binfmt_elf: Introduce KUnit test
2022-03-03 20:38:56 -08:00
coredump.c
fs: do not compare against ->llseek
2022-07-16 09:19:15 -04:00
d_path.c
…
dax.c
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
dcache.c
dcache: move the DCACHE_OP_COMPARE case out of the __d_lookup_rcu loop
2022-08-17 14:33:03 -07:00
direct-io.c
iov_iter: advancing variants of iov_iter_get_pages{,_alloc}()
2022-08-08 22:37:22 -04:00
drop_caches.c
…
eventfd.c
…
eventpoll.c
epoll: autoremove wakers even more aggressively
2022-07-17 17:31:40 -07:00
exec.c
execve fix for v6.0-rc2
2022-08-19 14:02:24 -07:00
fcntl.c
keep iocb_flags() result cached in struct file
2022-06-10 16:10:23 -04:00
fhandle.c
…
file_table.c
iov_iter work, part 1 - isolated cleanups and optimizations.
2022-08-03 13:50:22 -07:00
file.c
fix the breakage in close_fd_get_file() calling conventions change
2022-06-05 15:03:03 -04:00
filesystems.c
…
fs_context.c
vfs: fs_context: fix up param length parsing in legacy_parse_param
2022-01-18 09:23:19 +02:00
fs_parser.c
fs_parse: allow parameter value to be empty
2021-12-09 14:09:36 -05:00
fs_pin.c
…
fs_struct.c
…
fs_types.c
…
fs-writeback.c
writeback: avoid use-after-free after removing device
2022-08-28 14:02:43 -07:00
fsopen.c
uninline may_mount() and don't opencode it in fspick(2)/fsopen(2)
2022-05-19 23:25:10 -04:00
init.c
…
inode.c
fs: __file_remove_privs(): restore call to inode_has_no_xattr()
2022-08-18 09:39:33 +02:00
internal.h
Cleanups (and one fix) around struct mount handling.
2022-06-04 19:00:05 -07:00
ioctl.c
Fixes for 5.18-rc1:
2022-04-01 19:35:56 -07:00
Kconfig
mm: hugetlb_vmemmap: introduce the name HVO
2022-08-08 18:06:42 -07:00
Kconfig.binfmt
m68knommu: changes for linux 5.19
2022-05-30 10:56:18 -07:00
kernel_read_file.c
fs/kernel_read_file: allow to read files up-to ssize_t
2022-06-16 19:58:21 -07:00
libfs.c
fs: Convert simple_readpage to simple_read_folio
2022-05-09 16:21:44 -04:00
locks.c
locks: Fix dropped call to ->fl_release_private()
2022-08-17 15:08:58 -04:00
Makefile
io_uring: move to separate directory
2022-07-24 18:39:10 -06:00
mbcache.c
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
mount.h
switch try_to_unlazy_next() to __legitimize_mnt()
2022-07-05 16:18:21 -04:00
mpage.c
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
namei.c
fs.setgid.v6.0
2022-08-09 09:52:28 -07:00
namespace.c
fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts
2022-08-17 11:27:11 +02:00
no-block.c
…
nsfs.c
…
open.c
iov_iter work, part 1 - isolated cleanups and optimizations.
2022-08-03 13:50:22 -07:00
pipe.c
Not a lot of material this cycle. Many singleton patches against various
2022-05-27 11:22:03 -07:00
pnode.c
…
pnode.h
…
posix_acl.c
acl: handle idmapped mounts for idmapped filesystems
2022-08-17 11:23:31 +02:00
proc_namespace.c
vfs: escape hash as well
2022-06-28 13:58:05 -04:00
read_write.c
switch new_sync_{read,write}() to ITER_UBUF
2022-08-08 22:37:15 -04:00
readdir.c
…
remap_range.c
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
select.c
select: Fix indefinitely sleeping task in poll_schedule_timeout()
2022-01-11 09:03:05 -08:00
seq_file.c
rxrpc: Fix locking issue
2022-05-22 21:03:01 +01:00
signalfd.c
Merge branch 'signal-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2022-01-17 05:49:30 +02:00
splice.c
iter_to_pipe(): switch to advancing variant of iov_iter_get_pages()
2022-08-08 22:37:23 -04:00
stack.c
…
stat.c
RISC-V Patches for the 5.19 Merge Window, Part 1
2022-05-31 14:10:54 -07:00
statfs.c
…
super.c
fuse update for 6.0
2022-08-08 11:10:02 -07:00
sync.c
riscv: compat: syscall: Add compat_sys_call_table implementation
2022-04-26 13:36:25 -07:00
sysctls.c
fs: move namespace sysctls and declare fs base directory
2022-01-22 08:33:36 +02:00
timerfd.c
…
userfaultfd.c
mm/uffd: reset write protection when unregister with wp-mode
2022-08-20 15:17:45 -07:00
utimes.c
…
xattr.c
acl: move idmapped mount fixup into vfs_{g,s}etxattr()
2022-07-15 22:08:59 +02:00