Zhang Yi 5c48a7df91 ext4: fix an use-after-free issue about data=journal writeback mode ... Our syzkaller report an use-after-free issue that accessing the freed buffer_head on the writeback page in __ext4_journalled_writepage(). The problem is that if there was a truncate racing with the data=journalled writeback procedure, the writeback length could become zero and bget_one() refuse to get buffer_head's refcount, then the truncate procedure release buffer once we drop page lock, finally, the last ext4_walk_page_buffers() trigger the use-after-free problem. sync truncate ext4_sync_file() file_write_and_wait_range() ext4_setattr(0) inode->i_size = 0 ext4_writepage() len = 0 __ext4_journalled_writepage() page_bufs = page_buffers(page) ext4_walk_page_buffers(bget_one) <- does not get refcount do_invalidatepage() free_buffer_head() ext4_walk_page_buffers(page_bufs) <- trigger use-after-free After commit bdf96838ae ("ext4: fix race between truncate and __ext4_journalled_writepage()"), we have already handled the racing case, so the bget_one() and bput_one() are not needed. So this patch simply remove these hunk, and recheck the i_size to make it safe. Fixes: bdf96838ae ("ext4: fix race between truncate and __ext4_journalled_writepage()") Signed-off-by: Zhang Yi <yi.zhang@huawei.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211225090937.712867-1-yi.zhang@huawei.com Signed-off-by: Theodore Ts'o <tytso@mit.edu>		2022-01-10 13:25:55 -05:00
..
9p	netfs, 9p, afs, ceph: Use folios	2021-11-10 21:16:56 +00:00
adfs
affs	affs: use bdev_nr_sectors instead of open coding it	2021-10-18 14:43:22 -06:00
afs	afs: Use folios in directory handling	2021-11-10 21:17:09 +00:00
autofs	autofs: fix wait name hash calculation in autofs_wait()	2021-10-20 21:09:02 -04:00
befs
bfs
btrfs	for-5.16-rc2-tag	2021-11-26 11:24:32 -08:00
cachefiles	for-5.16/ki_complete-2021-10-29	2021-11-01 10:17:11 -07:00
ceph	One notable change here is that async creates and unlinks introduced	2021-11-13 11:31:07 -08:00
cifs	cifs: avoid use of dstaddr as key for fscache client cookie	2021-12-03 12:38:25 -06:00
coda	coda: bump module version to 7.2	2021-11-09 10:02:51 -08:00
configfs
cramfs	cramfs: use bdev_nr_bytes instead of open coding it	2021-10-18 14:43:22 -06:00
crypto	fscrypt: improve a few comments	2021-10-25 19:11:50 -07:00
debugfs
devpts
dlm
ecryptfs
efivarfs
efs
erofs	erofs: fix deadlock when shrink erofs slab	2021-11-23 14:58:16 +08:00
exfat	exfat: fix incorrect loading of i_blocks for large files	2021-11-01 07:49:21 +09:00
exportfs
ext2
ext4	ext4: fix an use-after-free issue about data=journal writeback mode	2022-01-10 13:25:55 -05:00
f2fs	Update to zstd-1.4.10	2021-11-13 15:32:30 -08:00
fat	for-5.16/inode-sync-2021-10-29	2021-11-01 10:25:27 -07:00
freevxfs
fscache
fuse	fuse: release pipe buf after last use	2021-11-25 14:05:18 +01:00
gfs2	gfs2: gfs2_create_inode rework	2021-12-02 12:41:10 +01:00
hfs	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
hfsplus	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
hostfs
hpfs	treewide: Replace open-coded flex arrays in unions	2021-10-18 12:28:53 -07:00
hugetlbfs	mm,hugetlb: remove mlock ulimit for SHM_HUGETLB	2021-11-09 10:02:48 -08:00
iomap	iomap: iomap_read_inline_data cleanup	2021-11-24 10:15:47 -08:00
isofs	isofs: Fix out of bound access for corrupted isofs image	2021-10-19 12:51:02 +02:00
jbd2	ext4: use ext4_journal_start/stop for fast commit transactions	2021-12-23 18:13:25 -05:00
jffs2
jfs	Just one JFS patch	2021-11-03 09:23:25 -07:00
kernfs	Merge 5.15-rc6 into driver-core-next	2021-10-18 09:43:37 +02:00
ksmbd	ksmbd: fix memleak in get_file_stream_info()	2021-11-25 00:09:26 -06:00
lockd	A slow cycle for nfsd: mainly cleanup, including Neil's patch dropping	2021-11-10 16:45:54 -08:00
minix
netfs	netfs: Adjust docs after foliation	2021-11-29 10:10:26 -08:00
nfs	NFS client bugfixes for Linux 5.16	2021-11-27 10:33:55 -08:00
nfs_common
nfsd	This is just one bugfix for a bufferflow in knfsd's xdr decoding.	2021-11-17 08:38:00 -08:00
nilfs2	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
nls
notify	fanotify: Allow users to request FAN_FS_ERROR events	2021-10-27 12:53:45 +02:00
ntfs	fs: ntfs: Limit NTFS_RW to page sizes smaller than 64k	2021-11-27 14:34:41 -08:00
ntfs3	gfs2: Fix mmap + page fault deadlocks	2021-11-02 12:25:03 -07:00
ocfs2	Merge branch 'exit-cleanups-for-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2021-11-10 16:15:54 -08:00
omfs
openpromfs
orangefs	orangefs: three fixes from other folks...	2021-11-09 10:34:06 -08:00
overlayfs	overlayfs update for 5.16	2021-11-09 10:51:12 -08:00
proc	proc/vmcore: fix clearing user buffer by properly using clear_user()	2021-11-20 10:35:55 -08:00
pstore	pstore/blk: Use "%lu" to format unsigned long	2021-11-21 09:44:19 -08:00
qnx4
qnx6
quota	\n	2021-11-06 16:40:48 -07:00
ramfs	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
reiserfs	\n	2021-11-06 16:40:48 -07:00
romfs
smbfs_common	cifs: Move SMB2_Create definitions to the shared area	2021-11-05 09:55:36 -05:00
squashfs	lib: zstd: Add kernel-specific API	2021-11-08 16:55:21 -08:00
sysfs
sysv	sysv: use BUILD_BUG_ON instead of runtime check	2021-11-09 10:02:52 -08:00
tracefs
ubifs
udf	udf: Fix crash after seekdir	2021-11-09 12:53:58 +01:00
ufs
unicode
vboxsf
verity
xfs	xfs: remove incorrect ASSERT in xfs_rename	2021-12-01 17:27:48 -08:00
zonefs	gfs2: Fix mmap + page fault deadlocks	2021-11-02 12:25:03 -07:00
aio.c	Various hardening fixes and cleanups for 5.16-rc1	2021-11-01 17:29:10 -07:00
anon_inodes.c
attr.c	fs: handle circular mappings correctly	2021-11-17 09:26:09 +01:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
binfmt_elf_fdpic.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
buffer.c	fs: simplify init_page_buffers	2021-10-18 14:43:22 -06:00
char_dev.c
compat_binfmt_elf.c
coredump.c
d_path.c	d_path: fix Kernel doc validator complaining	2021-11-06 13:30:32 -07:00
dax.c
dcache.c
direct-io.c	fs: get rid of the res2 iocb->ki_complete argument	2021-10-25 10:36:24 -06:00
drop_caches.c
eventfd.c
eventpoll.c
exec.c	Merge branch 'exit-cleanups-for-v5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2021-11-10 16:15:54 -08:00
fcntl.c
fhandle.c
file.c	fget: check that the fd still exists after getting a ref to it	2021-12-03 10:06:58 -08:00
file_table.c
filesystems.c
fs-writeback.c	Various hardening fixes and cleanups for 5.16-rc1	2021-11-01 17:29:10 -07:00
fs_context.c
fs_parser.c	fs_parse: allow parameter value to be empty	2021-12-09 14:09:36 -05:00
fs_pin.c
fs_struct.c
fs_types.c
fsopen.c
init.c
inode.c	fs: Remove FS_THP_SUPPORT	2021-11-17 10:36:35 -05:00
internal.h	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
io-wq.c	io-wq: don't retry task_work creation failure on fatal conditions	2021-12-03 06:27:32 -07:00
io-wq.h	io_uring: optimise INIT_WQ_LIST	2021-10-19 05:49:54 -06:00
io_uring.c	io_uring: Fix undefined-behaviour in io_issue_sqe	2021-11-27 06:41:38 -07:00
ioctl.c
Kconfig
Kconfig.binfmt
kernel_read_file.c	vfs: check fd has read access in kernel_read_file_from_fd()	2021-10-18 20:22:03 -10:00
libfs.c	libfs: Support RENAME_EXCHANGE in simple_rename()	2021-11-03 15:43:08 +01:00
locks.c	locks: remove changelog comments	2021-10-19 14:11:39 -04:00
Makefile
mbcache.c
mount.h
mpage.c
namei.c	File locking changes for v5.16	2021-11-01 09:06:53 -07:00
namespace.c
no-block.c
nsfs.c
open.c	Merge branch 'akpm' (patches from Andrew)	2021-11-06 14:08:17 -07:00
pipe.c
pnode.c
pnode.h
posix_acl.c	fs/posix_acl.c: avoid -Wempty-body warning	2021-11-06 13:30:32 -07:00
proc_namespace.c
read_write.c	fs: remove leftover comments from mandatory locking removal	2021-10-26 12:20:50 -04:00
readdir.c
remap_range.c
select.c
seq_file.c	seq_file: move seq_escape() to a header	2021-11-09 10:02:52 -08:00
signalfd.c
splice.c
stack.c
stat.c
statfs.c
super.c	fs: explicitly unregister per-superblock BDIs	2021-11-06 13:30:34 -07:00
sync.c	block: simplify the block device syncing code	2021-10-22 08:36:55 -06:00
timerfd.c
userfaultfd.c	userfaultfd: fix a race between writeprotect and exit_mmap()	2021-10-18 20:22:02 -10:00
utimes.c
xattr.c