mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-12 21:57:43 +00:00
Code Issues Releases Wiki Activity
linux-stable/fs
History
Theodore Ts'o d666dfaa57 ext4: don't BUG if someone dirty pages without asking ext4 first 
[ Upstream commit cc5095747e ]

[un]pin_user_pages_remote is dirtying pages without properly warning
the file system in advance.  A related race was noted by Jan Kara in
2018[1]; however, more recently instead of it being a very hard-to-hit
race, it could be reliably triggered by process_vm_writev(2) which was
discovered by Syzbot[2].

This is technically a bug in mm/gup.c, but arguably ext4 is fragile in
that if some other kernel subsystem dirty pages without properly
notifying the file system using page_mkwrite(), ext4 will BUG, while
other file systems will not BUG (although data will still be lost).

So instead of crashing with a BUG, issue a warning (since there may be
potential data loss) and just mark the page as clean to avoid
unprivileged denial of service attacks until the problem can be
properly fixed.  More discussion and background can be found in the
thread starting at [2].

[1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz
[2] https://lore.kernel.org/r/Yg0m6IjcNmfaSokM@google.com

Reported-by: syzbot+d59332e2db681cf18f0318a06e994ebbb529a8db@syzkaller.appspotmail.com
Reported-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/YiDS9wVfq4mM2jGK@mit.edu
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-20 09:08:22 +02:00
..
9p 9P: Cast to loff_t before multiplying 2020-11-05 11:07:03 +01:00
adfs fs/adfs: super: fix use-after-free bug 2019-08-06 19:05:21 +02:00
affs fs/affs: release old buffer head on error path 2021-03-03 18:22:54 +01:00
afs afs: Fix some tracing details 2020-04-02 16:34:33 +02:00
autofs4 autofs: fix a leak in autofs_expire_indirect() 2019-12-17 20:37:24 +01:00
befs
bfs bfs: add sanity check at bfs_fill_super() 2018-12-01 09:42:51 +01:00
btrfs btrfs: unlock newly allocated extent buffer after error 2022-03-16 12:57:09 +01:00
cachefiles cachefiles: Handle readpage error correctly 2020-11-05 11:07:05 +01:00
ceph ceph: lockdep annotations for try_nonblocking_invalidate 2021-09-26 13:37:29 +02:00
cifs cifs: fix double free race when mount fails in cifs_get_root() 2022-03-08 19:01:55 +01:00
coda coda: add error handling for fget 2019-08-06 19:05:23 +02:00
configfs configfs: fix a race in configfs_{,un}register_subsystem() 2022-03-02 11:33:56 +01:00
cramfs Cramfs: fix abad comparison when wrap-arounds occur 2018-11-13 11:15:12 -08:00
crypto fscrypt: don't ignore minor_hash when hash is 0 2021-07-20 16:17:45 +02:00
debugfs debugfs: fix use-after-free on symlink traversal 2019-05-08 07:20:49 +02:00
devpts fs/devpts: always delete dcache dentry-s in dput() 2019-03-23 14:35:21 +01:00
dlm fs: dlm: filter user dlm messages for kernel locks 2022-01-27 09:00:53 +01:00
ecryptfs Revert "ecryptfs: replace BUG_ON with error handling code" 2021-05-26 11:47:00 +02:00
efivarfs efivarfs: revert "fix memory leak in efivarfs_create()" 2020-12-02 08:34:44 +01:00
efs
exofs exofs_mount(): fix leaks on failure exits 2019-12-05 15:37:28 +01:00
exportfs exportfs: fix 'passing zero to ERR_PTR()' warning 2020-01-27 14:46:06 +01:00
ext2 ext2: correct max file size computing 2022-04-20 09:08:17 +02:00
ext4 ext4: don't BUG if someone dirty pages without asking ext4 first 2022-04-20 09:08:22 +02:00
f2fs f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() 2021-12-29 12:17:36 +01:00
fat fat: don't allow to mount if the FAT length == 0 2020-06-20 10:25:05 +02:00
freevxfs
fscache fscache: fix race between enablement and dropping of object 2018-12-17 09:28:53 +01:00
fuse fuse: fix pipe buffer lifetime for direct_io 2022-04-20 09:08:08 +02:00
gfs2 gfs2: Don't call dlm after protocol is unmounted 2021-09-22 11:45:30 +02:00
hfs hfs: add lock nesting notation to hfs_find_init 2021-08-04 12:22:15 +02:00
hfsplus hfsplus: fix crash and filesystem corruption when deleting files 2020-04-24 08:00:45 +02:00
hostfs
hpfs
hugetlbfs hugetlbfs: hugetlb_fault_mutex_hash() cleanup 2021-06-03 08:36:25 +02:00
isofs isofs: Fix out of bound access for corrupted isofs image 2021-11-12 14:28:24 +01:00
jbd2 jbd2: abort journal if free a async write error metadata buffer 2020-09-03 11:22:29 +02:00
jffs2 jffs2: fix memory leak in jffs2_scan_medium 2022-04-20 09:08:10 +02:00
jfs jfs: fix divide error in dbNextAG 2022-04-20 09:08:20 +02:00
kernfs kernfs: deal with kernfs_fill_super() failures 2021-06-30 08:48:55 -04:00
lockd lockd: don't use interval-based rebinding over TCP 2020-12-29 13:46:57 +01:00
minix fs/minix: reject too-large maximum file size 2020-08-21 09:48:15 +02:00
ncpfs
nfs NFSv4/pNFS: Fix another issue with a list iterator pointing to the head 2022-04-20 09:08:21 +02:00
nfs_common nfs_common: need lock during iterate through the list 2020-12-29 13:47:01 +01:00
nfsd NFSD: prevent underflow in nfssvc_decode_writeargs() 2022-04-20 09:08:09 +02:00
nilfs2 nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group 2021-09-26 13:37:30 +02:00
nls
notify fs: avoid softlockups in s_inodes iterators 2020-01-12 12:11:59 +01:00
ntfs ntfs: fix validity check for file name attribute 2021-07-20 16:17:28 +02:00
ocfs2 ocfs2: fix data corruption on truncate 2021-11-26 11:40:20 +01:00
omfs
openpromfs
orangefs orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() 2022-01-27 09:00:46 +01:00
overlayfs ovl: fix missing negative dentry check in ovl_rename() 2021-10-17 10:08:32 +02:00
proc proc/vmcore: fix clearing user buffer by properly using clear_user() 2021-12-08 08:46:52 +01:00
pstore pstore/ram: Write new dumps to start of recycled zones 2020-01-09 10:17:55 +01:00
qnx4 qnx4: work around gcc false positive warning bug 2021-10-06 15:05:08 +02:00
qnx6
quota quota: make dquot_quota_sync return errors from ->sync_fs 2022-02-23 11:57:33 +01:00
ramfs ramfs: fix nommu mmap with gaps in the page cache 2020-10-29 09:07:11 +01:00
reiserfs reiserfs: check directory items on read from disk 2021-08-15 13:03:33 +02:00
romfs romfs: fix uninitialized memory leak in romfs_dev_read() 2020-08-26 10:29:54 +02:00
squashfs squashfs: fix divide error in calculate_skip() 2021-05-22 10:57:39 +02:00
sysfs fs: sysfs_emit: Remove PAGE_SIZE alignment check 2022-03-23 09:01:35 +01:00
sysv sysv: return 'err' instead of 0 in __sysv_write_inode 2018-12-17 09:28:48 +01:00
tracefs tracefs: Set the group ownership in apply_options() not parse_options() 2022-03-02 11:33:58 +01:00
ubifs ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers 2022-01-27 09:00:59 +01:00
udf udf: Fix NULL ptr deref when converting from inline format 2022-02-08 18:16:24 +01:00
ufs fs/ufs: avoid potential u32 multiplication overflow 2020-08-21 09:48:22 +02:00
xfs xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate 2022-01-11 13:57:36 +01:00
aio.c aio: fix spectre gadget in lookup_ioctx 2018-12-21 14:13:04 +01:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf.c fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() 2020-06-03 08:18:03 +02:00
binfmt_elf_fdpic.c
binfmt_em86.c
binfmt_flat.c fs/binfmt_flat.c: make load_flat_shared_library() work 2019-07-03 13:15:59 +02:00
binfmt_misc.c binfmt_misc: fix possible deadlock in bm_register_write 2021-03-17 16:34:35 +01:00
binfmt_script.c exec: load_script: Do not exec truncated interpreter path 2019-11-06 12:42:59 +01:00
block_dev.c block: reexpand iov_iter after read/write 2021-05-22 10:57:43 +02:00
buffer.c fs: Don't invalidate page buffers in block_write_full_page() 2020-11-05 11:06:58 +01:00
char_dev.c chardev: Avoid potential use-after-free in 'chrdev_open()' 2020-01-14 20:05:39 +01:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP 2020-01-09 10:17:58 +01:00
coredump.c coredump: fix crash when umh is disabled 2020-05-20 08:16:58 +02:00
dax.c dax: pass NOWAIT flag to iomap_apply 2020-03-11 18:02:43 +01:00
dcache.c fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb() 2019-02-06 17:31:34 +01:00
dcookies.c
direct-io.c fs: direct-io: fix missing sdio->boundary 2021-04-16 11:57:48 +02:00
drop_caches.c fs: avoid softlockups in s_inodes iterators 2020-01-12 12:11:59 +01:00
eventfd.c
eventpoll.c ep_create_wakeup_source(): dentry name can change under you... 2020-10-14 09:51:09 +02:00
exec.c vfs: check fd has read access in kernel_read_file_from_fd() 2021-10-27 09:51:40 +02:00
fcntl.c
fhandle.c
file.c fget: clarify and improve __fget_files() implementation 2022-03-02 11:34:00 +01:00
file_table.c fs: add fget_many() and fput_many() 2021-12-08 08:46:55 +01:00
filesystems.c fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once() 2020-04-24 08:00:43 +02:00
fs-writeback.c writeback: fix obtain a reference to a freeing memcg css 2021-07-20 16:17:37 +02:00
fs_pin.c
fs_struct.c
inode.c futex: Fix inode life-time issue 2020-04-02 16:34:21 +02:00
internal.h
ioctl.c vfs: swap names of {do,vfs}_clone_file_range() 2018-11-10 07:48:33 -08:00
iomap.c iomap: Fix pipe page leakage during splicing 2019-12-17 20:38:57 +01:00
Kconfig
Kconfig.binfmt
libfs.c libfs: fix error cast of negative value in simple_attr_write() 2020-11-24 13:05:50 +01:00
locks.c locks: print unsigned ino in /proc/locks 2020-01-09 10:17:55 +01:00
Makefile
mbcache.c
mount.h
mpage.c
namei.c namei: only return -ECHILD from follow_dotdot_rcu() 2020-03-11 18:02:53 +01:00
namespace.c fs: warn about impending deprecation of mandatory locks 2021-08-26 08:37:10 -04:00
no-block.c
nsfs.c
open.c cifs_atomic_open(): fix double-put on late allocation failure 2020-03-20 10:54:16 +01:00
pipe.c pipe: increase minimum default pipe size to 2 pages 2021-08-15 13:03:31 +02:00
pnode.c propagate_one(): mnt_set_mountpoint() needs mount_lock 2020-05-02 17:24:47 +02:00
pnode.h
posix_acl.c
proc_namespace.c
read_write.c vfs: avoid problematic remapping requests into partial EOF block 2019-12-01 09:13:51 +01:00
readdir.c readdir: make sure to verify directory entry for legacy interfaces too 2021-04-28 12:08:41 +02:00
select.c kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data() 2021-03-24 11:05:05 +01:00
seq_file.c seq_file: disallow extremely large seq buffer allocations 2021-07-20 16:17:55 +02:00
signalfd.c signalfd: use wake_up_pollfree() 2021-12-14 10:16:55 +01:00
splice.c fs: prevent page refcount overflow in pipe_buf_get 2019-05-04 09:15:18 +02:00
stack.c
stat.c
statfs.c vfs: Fix EOVERFLOW testing in put_compat_statfs64 2019-10-11 18:18:48 +02:00
super.c vfs: make freeze_super abort when sync_filesystem returns error 2022-02-23 11:57:33 +01:00
sync.c
timerfd.c
userfaultfd.c userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK 2020-01-04 13:59:58 +01:00
utimes.c
xattr.c xattr: break delegations in {set,remove}xattr 2020-08-21 09:48:00 +02:00