mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-12 21:57:43 +00:00
Code Issues Releases Wiki Activity
linux-stable/fs/f2fs
History
Chao Yu e5142a4935 f2fs: fix to do sanity check on i_extra_isize in is_alive() 
commit d3b7b4afd6 upstream.

syzbot found a f2fs bug:

BUG: KASAN: slab-out-of-bounds in data_blkaddr fs/f2fs/f2fs.h:2891 [inline]
BUG: KASAN: slab-out-of-bounds in is_alive fs/f2fs/gc.c:1117 [inline]
BUG: KASAN: slab-out-of-bounds in gc_data_segment fs/f2fs/gc.c:1520 [inline]
BUG: KASAN: slab-out-of-bounds in do_garbage_collect+0x386a/0x3df0 fs/f2fs/gc.c:1734
Read of size 4 at addr ffff888076557568 by task kworker/u4:3/52

CPU: 1 PID: 52 Comm: kworker/u4:3 Not tainted 6.1.0-rc4-syzkaller-00362-gfef7fd48922d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:395
kasan_report+0xbb/0x1f0 mm/kasan/report.c:495
data_blkaddr fs/f2fs/f2fs.h:2891 [inline]
is_alive fs/f2fs/gc.c:1117 [inline]
gc_data_segment fs/f2fs/gc.c:1520 [inline]
do_garbage_collect+0x386a/0x3df0 fs/f2fs/gc.c:1734
f2fs_gc+0x88c/0x20a0 fs/f2fs/gc.c:1831
f2fs_balance_fs+0x544/0x6b0 fs/f2fs/segment.c:410
f2fs_write_inode+0x57e/0xe20 fs/f2fs/inode.c:753
write_inode fs/fs-writeback.c:1440 [inline]
__writeback_single_inode+0xcfc/0x1440 fs/fs-writeback.c:1652
writeback_sb_inodes+0x54d/0xf90 fs/fs-writeback.c:1870
wb_writeback+0x2c5/0xd70 fs/fs-writeback.c:2044
wb_do_writeback fs/fs-writeback.c:2187 [inline]
wb_workfn+0x2dc/0x12f0 fs/fs-writeback.c:2227
process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e4/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

The root cause is that we forgot to do sanity check on .i_extra_isize
in below path, result in accessing invalid address later, fix it.
- gc_data_segment
 - is_alive
  - data_blkaddr
   - offset_in_addr

Reported-by: syzbot+f8f3dfa4abc489e768a1@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-f2fs-devel/0000000000003cb3c405ed5c17f9@google.com/T/#u
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-02-22 12:50:29 +01:00
..
acl.c f2fs: Replace spaces with tab 2019-05-08 21:23:11 -07:00
acl.h
checkpoint.c f2fs: fix to do sanity check on destination blkaddr during recovery 2022-10-26 13:22:17 +02:00
data.c f2fs: fix to avoid potential deadlock 2022-04-15 14:18:06 +02:00
debug.c f2fs: avoid race condition for shrinker count 2021-01-06 14:48:40 +01:00
dir.c f2fs: reduce the scope of setting fsck tag when de->name_len is zero 2021-09-22 12:26:23 +02:00
extent_cache.c f2fs: let's avoid panic if extent_tree is not created 2023-01-24 07:17:58 +01:00
f2fs.h f2fs: fix to do sanity check on destination blkaddr during recovery 2022-10-26 13:22:17 +02:00
file.c f2fs: fix fallocate to use file_modified to update permissions consistently 2022-06-14 18:11:44 +02:00
gc.c f2fs: fix to do sanity check on i_extra_isize in is_alive() 2023-02-22 12:50:29 +01:00
gc.h
hash.c f2fs: Support case-insensitive file name lookups 2019-08-23 07:57:13 -07:00
inline.c f2fs: fix a redundant call to f2fs_balance_fs if an error occurs 2021-05-19 10:08:25 +02:00
inode.c f2fs: fix to clear dirty inode in f2fs_evict_inode() 2022-06-14 18:11:44 +02:00
Kconfig f2fs: Add a small clarification to CONFIG_FS_F2FS_FS_SECURITY 2019-09-16 08:38:48 -07:00
Makefile f2fs: add fs-verity support 2019-08-12 19:33:51 -07:00
namei.c f2fs: should use GFP_NOFS for directory inodes 2021-11-17 09:48:49 +01:00
node.c f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() 2022-08-25 11:18:38 +02:00
node.h f2fs: avoid race condition for shrinker count 2021-01-06 14:48:40 +01:00
recovery.c f2fs: fix to do sanity check on summary info 2022-10-26 13:22:17 +02:00
segment.c f2fs: fix normal discard process 2023-01-18 11:41:17 +01:00
segment.h f2fs: fix deadloop in foreground GC 2022-06-14 18:11:44 +02:00
shrinker.c f2fs: avoid race condition for shrinker count 2021-01-06 14:48:40 +01:00
super.c f2fs: increase the limit for reserve_root 2022-10-26 13:22:17 +02:00
sysfs.c f2fs: fix to reserve space for IO align feature 2022-01-27 09:19:53 +01:00
trace.c f2fs: do not use mutex lock in atomic context 2019-03-05 19:58:06 -08:00
trace.h
verity.c f2fs: fix error handling in f2fs_end_enable_verity() 2021-05-19 10:08:32 +02:00
xattr.c f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() 2021-12-29 12:23:37 +01:00
xattr.h f2fs: add fs-verity support 2019-08-12 19:33:51 -07:00