mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-06 16:49:22 +00:00
Code Issues Releases Wiki Activity
linux-stable/fs
History
Ryusuke Konishi bae3a1b766 nilfs2: fix possible out-of-bounds segment allocation in resize ioctl 
commit fee5eaecca upstream.

Syzbot reports that in its stress test for resize ioctl, the log writing
function nilfs_segctor_do_construct hits a WARN_ON in
nilfs_segctor_truncate_segments().

It turned out that there is a problem with the current implementation of
the resize ioctl, which changes the writable range on the device (the
range of allocatable segments) at the end of the resize process.

This order is necessary for file system expansion to avoid corrupting the
superblock at trailing edge.  However, in the case of a file system
shrink, if log writes occur after truncating out-of-bounds trailing
segments and before the resize is complete, segments may be allocated from
the truncated space.

The userspace resize tool was fine as it limits the range of allocatable
segments before performing the resize, but it can run into this issue if
the resize ioctl is called alone.

Fix this issue by changing nilfs_sufile_resize() to update the range of
allocatable segments immediately after successful truncation of segment
space in case of file system shrink.

Link: https://lkml.kernel.org/r/20230524094348.3784-1-konishi.ryusuke@gmail.com
Fixes: 4e33f9eab0 ("nilfs2: implement resize ioctl")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+33494cd0df2ec2931851@syzkaller.appspotmail.com
Closes: https://lkml.kernel.org/r/0000000000005434c405fbbafdc5@google.com
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-21 15:39:57 +02:00
..
9p 9p: missing chunk of "fs/9p: Don't update file type when updating file attributes" 2022-06-25 11:48:57 +02:00
adfs
affs affs: initialize fsdata in affs_truncate() 2023-02-06 07:49:38 +01:00
afs afs: Fix dynamic root getattr 2022-07-02 16:27:33 +02:00
autofs
befs
bfs
btrfs btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() 2023-06-14 10:57:14 +02:00
cachefiles cachefiles: Handle readpage error correctly 2020-11-05 11:08:54 +01:00
ceph ceph: fix use-after-free bug for inodes when flushing capsnaps 2023-06-14 10:57:14 +02:00
cifs cifs: fix pcchunk length type in smb2_copychunk_range 2023-05-17 11:13:25 +02:00
coda
configfs configfs: fix a race in configfs_{,un}register_subsystem() 2022-03-02 11:38:13 +01:00
cramfs
crypto fscrypt: add fscrypt_symlink_getattr() for computing st_size 2021-09-22 11:47:56 +02:00
debugfs debugfs: regset32: Add Runtime PM support 2023-05-17 11:13:06 +02:00
devpts
dlm fs: dlm: handle -EBUSY first in lock arg validation 2022-10-26 13:19:21 +02:00
ecryptfs Revert "ecryptfs: replace BUG_ON with error handling code" 2021-05-26 11:48:34 +02:00
efivarfs efivarfs: revert "fix memory leak in efivarfs_create()" 2020-12-02 08:48:12 +01:00
efs
exofs
exportfs exportfs: fix 'passing zero to ERR_PTR()' warning 2020-01-27 14:50:02 +01:00
ext2 ext2: Check block size validity during mount 2023-05-30 12:42:08 +01:00
ext4 ext4: only check dquot_initialize_needed() when debugging 2023-06-14 10:57:14 +02:00
f2fs f2fs: fix to drop all dirty pages during umount() if cp_error is set 2023-05-30 12:42:09 +01:00
fat fat: add ratelimit to fat*_ent_bread() 2022-06-14 16:59:18 +02:00
freevxfs
fscache fscache: Fix cookie key hashing 2021-09-22 11:48:02 +02:00
fuse fuse: limit nsec 2022-08-25 11:14:55 +02:00
gfs2 gfs2: Fix inode height consistency check 2023-05-30 12:42:09 +01:00
hfs hfs: fix missing hfs_bnode_get() in __hfs_bnode_create 2023-03-11 16:31:49 +01:00
hfsplus fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() 2023-05-30 12:42:08 +01:00
hostfs
hpfs
hugetlbfs hugetlbfs: hugetlb_fault_mutex_hash() cleanup 2021-06-03 08:38:12 +02:00
isofs isofs: Fix out of bound access for corrupted isofs image 2021-11-12 14:40:50 +01:00
jbd2 jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted 2022-08-25 11:15:19 +02:00
jffs2 jffs2: correct logic when creating a hole in jffs2_write_begin 2023-03-22 13:27:11 +01:00
jfs fs/jfs: fix shift exponent db_agl2size negative 2023-03-11 16:31:55 +01:00
kernfs kernfs: fix use-after-free in __kernfs_remove 2022-11-03 23:52:29 +09:00
lockd lockd: don't use interval-based rebinding over TCP 2020-12-30 11:25:59 +01:00
minix minix: fix bug when opening a file with O_DIRECT 2022-04-15 14:15:03 +02:00
nfs NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease 2023-05-17 11:13:19 +02:00
nfs_common nfs_common: need lock during iterate through the list 2020-12-30 11:26:02 +01:00
nfsd nfsd: fix race to check ls_layouts 2023-03-11 16:31:42 +01:00
nilfs2 nilfs2: fix possible out-of-bounds segment allocation in resize ioctl 2023-06-21 15:39:57 +02:00
nls
notify fsnotify: fix wrong lockdep annotations 2022-06-14 16:59:20 +02:00
ntfs ntfs: check overflow when iterating ATTR_RECORDs 2022-11-25 17:40:30 +01:00
ocfs2 ocfs2: check new file size on fallocate call 2023-06-21 15:39:57 +02:00
omfs
openpromfs
orangefs orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() 2023-01-18 11:30:37 +01:00
overlayfs ovl: Use ovl mounter's fsuid and fsgid in ovl_link() 2023-01-18 11:30:40 +01:00
proc mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps 2023-02-22 12:47:15 +01:00
pstore pstore: Revert pmsg_lock back to a normal mutex 2023-05-17 11:13:15 +02:00
qnx4 qnx4: work around gcc false positive warning bug 2021-10-06 15:31:20 +02:00
qnx6
quota ext4: fix bug_on in __es_tree_search caused by bad quota inode 2023-01-18 11:30:53 +01:00
ramfs ramfs: fix nommu mmap with gaps in the page cache 2020-10-30 10:38:21 +01:00
reiserfs reiserfs: Add security prefix to xattr name in reiserfs_security_write() 2023-05-17 11:13:07 +02:00
romfs romfs: fix uninitialized memory leak in romfs_dev_read() 2020-08-26 10:30:59 +02:00
squashfs revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" 2023-02-22 12:47:20 +01:00
sysfs fs: sysfs_emit_at: Remove PAGE_SIZE alignment check 2023-03-22 13:27:08 +01:00
sysv fs: sysv: Fix sysv_nblocks() returns wrong value 2023-01-18 11:30:08 +01:00
tracefs tracefs: Only clobber mode/uid/gid on remount if asked 2022-09-20 12:26:48 +02:00
ubifs ubifs: Free memory for tmpfile name 2023-05-17 11:13:08 +02:00
udf udf: Detect system inodes linked into directory hierarchy 2023-03-17 08:31:42 +01:00
ufs fs/ufs: avoid potential u32 multiplication overflow 2020-08-21 11:05:38 +02:00
xfs xfs: remove incorrect ASSERT in xfs_rename 2022-07-12 16:29:02 +02:00
aio.c aio: fix mremap after fork null-deref 2023-02-22 12:47:19 +01:00
anon_inodes.c
attr.c vfs: Check the truncate maximum size in inode_newsize_ok() 2022-08-25 11:14:53 +02:00
bad_inode.c
binfmt_aout.c binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf 2023-01-18 11:30:42 +01:00
binfmt_elf.c elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings 2021-10-06 15:31:24 +02:00
binfmt_elf_fdpic.c binfmt: Fix error return code in load_elf_fdpic_binary() 2023-01-18 11:30:42 +01:00
binfmt_em86.c
binfmt_flat.c binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf 2023-01-18 11:30:42 +01:00
binfmt_misc.c binfmt_misc: fix shift-out-of-bounds in check_special_flags 2023-01-18 11:30:33 +01:00
binfmt_script.c
block_dev.c block: reexpand iov_iter after read/write 2021-05-22 10:59:49 +02:00
buffer.c mm: fs: initialize fsdata passed to write_begin/write_end interface 2022-11-25 17:40:29 +01:00
char_dev.c chardev: fix error handling in cdev_device_add() 2023-01-18 11:30:27 +01:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP 2020-01-09 10:19:07 +01:00
coredump.c coredump: fix crash when umh is disabled 2020-05-14 07:57:21 +02:00
d_path.c
dax.c dax: fix cache flush on PMD-mapped pages 2022-06-14 16:59:24 +02:00
dcache.c fs, fscrypt: clear DCACHE_ENCRYPTED_NAME when unaliasing directory 2020-11-05 11:08:35 +01:00
dcookies.c
direct-io.c fs: direct-io: fix missing sdio->boundary 2021-04-14 08:22:32 +02:00
drop_caches.c fs: avoid softlockups in s_inodes iterators 2020-01-12 12:17:20 +01:00
eventfd.c eventfd: track eventfd_signal() recursion depth 2020-02-11 04:34:08 -08:00
eventpoll.c ep_create_wakeup_source(): dentry name can change under you... 2020-10-07 08:00:09 +02:00
exec.c exec: Force single empty string when argv is empty 2022-06-06 08:24:21 +02:00
fcntl.c fcntl: fix potential deadlock for &fasync_struct.fa_lock 2021-09-22 11:47:50 +02:00
fhandle.c
file.c fs: prevent out-of-bounds array speculation when closing a file descriptor 2023-03-17 08:31:41 +01:00
file_table.c fs: add fget_many() and fput_many() 2021-12-08 08:50:13 +01:00
filesystems.c fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once() 2020-04-17 10:48:51 +02:00
fs-writeback.c writeback: fix call of incorrect macro 2023-05-17 11:13:23 +02:00
fs_pin.c
fs_struct.c
inode.c fs: fix UAF/GPF bug in nilfs_mdt_destroy 2022-10-26 13:19:16 +02:00
internal.h
ioctl.c
iomap.c iomap: fix sub-page uptodate handling 2021-05-22 10:59:50 +02:00
Kconfig
Kconfig.binfmt
libfs.c libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value 2023-01-18 11:30:06 +01:00
locks.c locks: print unsigned ino in /proc/locks 2020-01-09 10:19:00 +01:00
Makefile
mbcache.c mbcache: Avoid nesting of cache->c_list_lock under bit locks 2023-01-18 11:30:51 +01:00
mount.h
mpage.c
namei.c mm: fs: initialize fsdata passed to write_begin/write_end interface 2022-11-25 17:40:29 +01:00
namespace.c VFS: Fix memory leak caused by concurrently mounting fs with subtype 2022-05-15 19:41:59 +02:00
no-block.c
nsfs.c
open.c cifs_atomic_open(): fix double-put on late allocation failure 2020-03-18 07:14:21 +01:00
pipe.c pipe: increase minimum default pipe size to 2 pages 2021-08-12 13:19:43 +02:00
pnode.c pnode: terminate at peers of source 2023-01-18 11:30:40 +01:00
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c readdir: make sure to verify directory entry for legacy interfaces too 2021-04-28 13:16:50 +02:00
select.c select: Fix indefinitely sleeping task in poll_schedule_timeout() 2022-01-29 10:19:18 +01:00
seq_file.c seq_file: disallow extremely large seq buffer allocations 2021-07-20 16:16:16 +02:00
signalfd.c signalfd: use wake_up_pollfree() 2021-12-14 10:18:07 +01:00
splice.c Revert "fs: check FMODE_LSEEK to control internal pipe splicing" 2022-10-26 13:19:21 +02:00
stack.c
stat.c stat: fix inconsistency between struct stat and struct compat_stat 2022-04-27 13:39:44 +02:00
statfs.c statfs: enforce statfs[64] structure initialization 2023-05-30 12:42:11 +01:00
super.c vfs: make freeze_super abort when sync_filesystem returns error 2022-02-23 11:58:38 +01:00
sync.c
timerfd.c
userfaultfd.c userfaultfd: prevent concurrent API initialization 2021-09-22 11:48:02 +02:00
utimes.c
xattr.c fs: don't audit the capability check in simple_xattr_list() 2023-01-18 11:30:04 +01:00