Eric Biggers b47c690109 ext4: don't allow journal inode to have encrypt flag ... commit 105c78e124 upstream. Mounting a filesystem whose journal inode has the encrypt flag causes a NULL dereference in fscrypt_limit_io_blocks() when the 'inlinecrypt' mount option is used. The problem is that when jbd2_journal_init_inode() calls bmap(), it eventually finds its way into ext4_iomap_begin(), which calls fscrypt_limit_io_blocks(). fscrypt_limit_io_blocks() requires that if the inode is encrypted, then its encryption key must already be set up. That's not the case here, since the journal inode is never "opened" like a normal file would be. Hence the crash. A reproducer is: mkfs.ext4 -F /dev/vdb debugfs -w /dev/vdb -R "set_inode_field <8> flags 0x80808" mount /dev/vdb /mnt -o inlinecrypt To fix this, make ext4 consider journal inodes with the encrypt flag to be invalid. (Note, maybe other flags should be rejected on the journal inode too. For now, this is just the minimal fix for the above issue.) I've marked this as fixing the commit that introduced the call to fscrypt_limit_io_blocks(), since that's what made an actual crash start being possible. But this fix could be applied to any version of ext4 that supports the encrypt feature. Reported-by: syzbot+ba9dac45bc76c490b7c3@syzkaller.appspotmail.com Fixes: 38ea50daa7 ("ext4: support direct I/O with fscrypt using blk-crypto") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Link: https://lore.kernel.org/r/20221102053312.189962-1-ebiggers@kernel.org Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-01-18 11:41:59 +01:00
..
9p	9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"	2022-06-22 14:11:02 +02:00
adfs
affs	fs/affs: release old buffer head on error path	2021-03-04 10:26:48 +01:00
afs	afs: Fix fileserver probe RTT handling	2022-12-08 11:23:03 +01:00
autofs
befs
bfs	bfs: don't use WARNING: string when it's just info.	2021-01-06 14:48:39 +01:00
btrfs	btrfs: replace strncpy() with strscpy()	2023-01-18 11:41:52 +01:00
cachefiles	cachefiles: Handle readpage error correctly	2020-11-05 11:43:36 +01:00
ceph	ceph: avoid putting the realm twice when decoding snaps fails	2022-12-08 11:23:00 +01:00
cifs	cifs: fix missing display of three mount options	2023-01-18 11:41:49 +01:00
coda
configfs	configfs: fix possible memory leak in configfs_create_dir()	2023-01-18 11:41:09 +01:00
cramfs
crypto	fscrypt: add fscrypt_symlink_getattr() for computing st_size	2021-09-12 08:56:38 +02:00
debugfs	debugfs: fix error when writing negative value to atomic_t debugfs file	2023-01-18 11:40:56 +01:00
devpts	fsnotify: fix fsnotify hooks in pseudo filesystems	2022-02-01 17:24:34 +01:00
dlm	fs: dlm: handle -EBUSY first in lock arg validation	2022-10-26 13:22:14 +02:00
ecryptfs	Revert "ecryptfs: replace BUG_ON with error handling code"	2021-05-26 12:05:19 +02:00
efivarfs	efivarfs: revert "fix memory leak in efivarfs_create()"	2020-12-02 08:49:53 +01:00
efs
erofs	erofs: avoid consecutive detection for Highmem memory	2022-08-25 11:17:36 +02:00
exportfs
ext2	ext2: Add more validity checks for inode counts	2022-08-25 11:17:28 +02:00
ext4	ext4: don't allow journal inode to have encrypt flag	2023-01-18 11:41:59 +01:00
f2fs	f2fs: should put a page when checking the summary info	2023-01-18 11:41:44 +01:00
fat	fat: add ratelimit to fat*_ent_bread()	2022-06-14 18:11:30 +02:00
freevxfs
fscache	fscache: Fix cookie key hashing	2021-09-22 12:26:25 +02:00
fuse	fuse: lock inode unconditionally in fuse_fallocate()	2022-12-08 11:23:01 +01:00
gfs2	gfs2: Switch from strlcpy to strscpy	2022-11-25 17:42:22 +01:00
hfs	hfs: fix OOB Read in __hfs_brec_find	2023-01-18 11:41:34 +01:00
hfsplus	hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount	2023-01-18 11:41:43 +01:00
hostfs	hostfs: fix memory handling in follow_link()	2021-04-14 08:24:14 +02:00
hpfs
hugetlbfs	hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()	2023-01-18 11:41:38 +01:00
iomap	iomap: iomap_write_failed fix	2022-06-14 18:11:36 +02:00
isofs	isofs: Fix out of bound access for corrupted isofs image	2021-11-12 14:43:03 +01:00
jbd2	jbd2: wake up journal waiters in FIFO order, not LIFO	2022-10-26 13:22:17 +02:00
jffs2	jffs2: fix memory leak in jffs2_do_fill_super	2022-06-14 18:11:55 +02:00
jfs	fs: jfs: fix shift-out-of-bounds in dbDiscardAG	2023-01-18 11:41:34 +01:00
kernfs	kernfs: fix use-after-free in __kernfs_remove	2022-11-03 23:56:54 +09:00
lockd	lockd: lockd server-side shouldn't set fl_ops	2021-09-22 12:26:34 +02:00
minix	minix: fix bug when opening a file with O_DIRECT	2022-04-15 14:18:35 +02:00
nfs	NFSv4.x: Fail client initialisation if state manager thread can't run	2023-01-18 11:41:10 +01:00
nfs_common	nfs_common: need lock during iterate through the list	2020-12-30 11:51:22 +01:00
nfsd	nfsd: fix handling of readdir in v4root vs. mount upcall timeout	2023-01-18 11:41:59 +01:00
nilfs2	nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()	2023-01-18 11:41:34 +01:00
nls
notify	fsnotify: fix wrong lockdep annotations	2022-06-14 18:11:34 +02:00
ntfs	ntfs: check overflow when iterating ATTR_RECORDs	2022-11-25 17:42:22 +01:00
ocfs2	ocfs2: fix memory leak in ocfs2_mount_volume()	2023-01-18 11:40:56 +01:00
omfs
openpromfs
orangefs	orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()	2023-01-18 11:41:39 +01:00
overlayfs	ovl: Use ovl mounter's fsuid and fsgid in ovl_link()	2023-01-18 11:41:43 +01:00
proc	mm: /proc/pid/smaps_rollup: fix no vma's null-deref	2022-10-29 10:20:36 +02:00
pstore	pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES	2023-01-18 11:41:40 +01:00
qnx4	qnx4: work around gcc false positive warning bug	2021-09-30 10:09:26 +02:00
qnx6
quota	quota: Check next/prev free block number after reading from quota file	2022-10-26 13:22:14 +02:00
ramfs	ramfs: fix nommu mmap with gaps in the page cache	2020-10-29 09:57:53 +01:00
reiserfs	reiserfs: Add missing calls to reiserfs_security_free()	2023-01-18 11:41:41 +01:00
romfs
squashfs	squashfs: fix divide error in calculate_skip()	2021-05-19 10:08:29 +02:00
sysfs	sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output	2021-03-07 12:20:48 +01:00
sysv	fs: sysv: Fix sysv_nblocks() returns wrong value	2023-01-18 11:40:58 +01:00
tracefs	tracefs: Only clobber mode/uid/gid on remount if asked	2022-09-20 12:28:00 +02:00
ubifs	ubifs: Rectify space amount budget for mkdir/tmpfile operations	2022-04-15 14:18:31 +02:00
udf	udf: Fix extension of the last extent in the file	2023-01-18 11:41:58 +01:00
ufs
unicode
verity	fs-verity: fix signed integer overflow with i_size near S64_MAX	2021-10-06 15:42:30 +02:00
xfs	xfs: drain the buf delwri queue before xfsaild idles	2022-11-25 17:42:03 +01:00
aio.c	aio: fix use-after-free due to missing POLLFREE handling	2021-12-14 14:49:02 +01:00
anon_inodes.c
attr.c	vfs: Check the truncate maximum size in inode_newsize_ok()	2022-08-25 11:17:21 +02:00
bad_inode.c
binfmt_aout.c	binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf	2023-01-18 11:41:46 +01:00
binfmt_elf.c	elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings	2021-10-06 15:42:35 +02:00
binfmt_elf_fdpic.c	binfmt: Fix error return code in load_elf_fdpic_binary()	2023-01-18 11:41:46 +01:00
binfmt_em86.c
binfmt_flat.c	binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf	2023-01-18 11:41:46 +01:00
binfmt_misc.c	binfmt_misc: fix shift-out-of-bounds in check_special_flags	2023-01-18 11:41:33 +01:00
binfmt_script.c
block_dev.c	block: reexpand iov_iter after read/write	2021-05-22 11:38:29 +02:00
buffer.c	mm: fs: initialize fsdata passed to write_begin/write_end interface	2022-11-25 17:42:22 +01:00
char_dev.c	chardev: fix error handling in cdev_device_add()	2023-01-18 11:41:25 +01:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c	compat_ioctl: remove /dev/random commands	2022-06-22 14:11:03 +02:00
coredump.c	coredump: fix core_pattern parse error	2020-12-11 13:23:30 +01:00
d_path.c	fs: fix NULL dereference due to data race in prepend_path()	2020-10-29 09:57:45 +01:00
dax.c	dax: fix cache flush on PMD-mapped pages	2022-06-14 18:11:41 +02:00
dcache.c
dcookies.c
direct-io.c	fs: direct-io: fix missing sdio->boundary	2021-04-14 08:24:11 +02:00
drop_caches.c
eventfd.c
eventpoll.c	epoll: check for events when removing a timed out thread from the wait queue	2022-12-08 11:23:05 +01:00
exec.c	exec: Force single empty string when argv is empty	2022-06-06 08:33:50 +02:00
fcntl.c	fcntl: fix potential deadlock for &fasync_struct.fa_lock	2021-09-15 09:47:28 +02:00
fhandle.c
file.c	fget: clarify and improve __fget_files() implementation	2022-03-02 11:41:18 +01:00
file_table.c	SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()	2022-05-25 09:14:34 +02:00
filesystems.c
fs-writeback.c	fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages	2022-06-14 18:11:44 +02:00
fs_context.c	memcg: charge fs_context and legacy_fs_context	2022-02-08 18:24:29 +01:00
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fsopen.c
inode.c	fs: fix UAF/GPF bug in nilfs_mdt_destroy	2022-10-15 07:54:36 +02:00
internal.h	cgroup1: fix leaked context root causing sporadic NULL deref in LTP	2021-07-31 08:19:37 +02:00
io_uring.c	io_uring/af_unix: defer registered files gc to io_uring release	2022-10-26 13:22:59 +02:00
ioctl.c
Kconfig
Kconfig.binfmt
libfs.c	libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value	2023-01-18 11:40:55 +01:00
locks.c
Makefile
mbcache.c	ext4: fix deadlock due to mbcache entry corruption	2023-01-18 11:41:56 +01:00
mount.h
mpage.c
namei.c	mm: fs: initialize fsdata passed to write_begin/write_end interface	2022-11-25 17:42:22 +01:00
namespace.c	fs: warn about impending deprecation of mandatory locks	2021-08-26 08:36:22 -04:00
no-block.c
nsfs.c
open.c
pipe.c	pipe: increase minimum default pipe size to 2 pages	2021-08-12 13:21:02 +02:00
pnode.c	pnode: terminate at peers of source	2023-01-18 11:41:44 +01:00
pnode.h	mount: fix mounting of detached mounts onto targets that reside on shared mounts	2021-03-17 17:03:33 +01:00
posix_acl.c
proc_namespace.c
read_write.c
readdir.c	readdir: make sure to verify directory entry for legacy interfaces too	2021-04-21 12:56:16 +02:00
select.c	select: Fix indefinitely sleeping task in poll_schedule_timeout()	2022-01-29 10:25:11 +01:00
seq_file.c	seq_file: disallow extremely large seq buffer allocations	2021-07-20 16:10:54 +02:00
signalfd.c	io_uring: disable polling pollfree files	2022-09-05 10:27:47 +02:00
splice.c	Revert "fs: check FMODE_LSEEK to control internal pipe splicing"	2022-10-17 17:24:32 +02:00
stack.c
stat.c	stat: fix inconsistency between struct stat and struct compat_stat	2022-04-27 13:50:48 +02:00
statfs.c
super.c	vfs: make freeze_super abort when sync_filesystem returns error	2022-02-23 11:59:55 +01:00
sync.c
timerfd.c
userfaultfd.c	userfaultfd: open userfaultfds with O_RDONLY	2022-10-26 13:22:21 +02:00
utimes.c
xattr.c	fs: don't audit the capability check in simple_xattr_list()	2023-01-18 11:40:53 +01:00