Ryusuke Konishi 793d0224bb nilfs2: prevent general protection fault in nilfs_clear_dirty_page() ... commit 782e53d0c1 upstream. In a syzbot stress test that deliberately causes file system errors on nilfs2 with a corrupted disk image, it has been reported that nilfs_clear_dirty_page() called from nilfs_clear_dirty_pages() can cause a general protection fault. In nilfs_clear_dirty_pages(), when looking up dirty pages from the page cache and calling nilfs_clear_dirty_page() for each dirty page/folio retrieved, the back reference from the argument page to "mapping" may have been changed to NULL (and possibly others). It is necessary to check this after locking the page/folio. So, fix this issue by not calling nilfs_clear_dirty_page() on a page/folio after locking it in nilfs_clear_dirty_pages() if the back reference "mapping" from the page/folio is different from the "mapping" that held the page/folio just before. Link: https://lkml.kernel.org/r/20230612021456.3682-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Reported-by: syzbot+53369d11851d8f26735c@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/000000000000da4f6b05eb9bf593@google.com Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-06-28 10:29:45 +02:00
..
9p	9p: fix a bunch of checkpatch warnings	2022-08-17 14:24:07 +02:00
adfs
affs	affs: initialize fsdata in affs_truncate()	2023-02-01 08:27:06 +01:00
afs	afs: Fix vlserver probe RTT handling	2023-06-21 15:59:18 +02:00
autofs
befs
bfs
btrfs	btrfs: handle memory allocation failure in btrfs_csum_one_bio	2023-06-21 15:59:13 +02:00
cachefiles	fs: add is_idmapped_mnt() helper	2022-07-02 16:41:14 +02:00
ceph	ceph: fix use-after-free bug for inodes when flushing capsnaps	2023-06-14 11:13:06 +02:00
cifs	cifs: fix lease break oops in xfstest generic/098	2023-06-21 15:59:18 +02:00
coda	coda: Avoid partial allocation of sig_inputArgs	2023-03-10 09:39:50 +01:00
configfs	configfs: fix possible memory leak in configfs_create_dir()	2022-12-31 13:14:15 +01:00
cramfs
crypto	fscrypt: fix keyring memory leak on mount failure	2022-11-10 18:15:37 +01:00
debugfs	debugfs: fix error when writing negative value to atomic_t debugfs file	2022-12-31 13:14:03 +01:00
devpts	fsnotify: fix fsnotify hooks in pseudo filesystems	2022-02-01 17:27:01 +01:00
dlm	fs: dlm: start midcomms before scand	2023-03-17 08:48:50 +01:00
ecryptfs	fs: add is_idmapped_mnt() helper	2022-07-02 16:41:14 +02:00
efivarfs
efs
erofs	erofs: fix potential overflow calculating xattr_isize	2023-05-11 23:00:20 +09:00
exfat	exfat: fix inode->i_blocks for non-512 byte sector size device	2023-03-10 09:39:58 +01:00
exportfs	exportfs: support idmapped mounts	2022-06-09 10:23:32 +02:00
ext2	ext2: Check block size validity during mount	2023-05-24 17:36:44 +01:00
ext4	ext4: drop the call to ext4_error() from ext4_get_group_info()	2023-06-21 15:59:18 +02:00
f2fs	f2fs: fix iostat lock protection	2023-06-14 11:13:00 +02:00
fat	fat: add ratelimit to fat*_ent_bread()	2022-06-09 10:22:42 +02:00
freevxfs
fscache
fuse	fuse: fix deadlock between atomic O_TRUNC and page invalidation	2023-04-26 13:51:54 +02:00
gfs2	gfs2: Don't deref jdesc in evict	2023-06-09 10:32:21 +02:00
hfs	hfs: fix missing hfs_bnode_get() in __hfs_bnode_create	2023-03-10 09:39:57 +01:00
hfsplus	fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()	2023-05-24 17:36:43 +01:00
hostfs
hpfs
hugetlbfs	hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()	2022-12-31 13:14:44 +01:00
iomap	iomap: iomap_write_failed fix	2022-06-09 10:22:55 +02:00
isofs
jbd2	jdb2: Don't refuse invalidation of already invalidated buffers	2023-05-11 23:00:29 +09:00
jffs2	jffs2: correct logic when creating a hole in jffs2_write_begin	2023-03-22 13:31:30 +01:00
jfs	fs/jfs: fix shift exponent db_agl2size negative	2023-03-11 13:57:22 +01:00
kernfs	kernfs: fix use-after-free in __kernfs_remove	2022-11-03 23:59:13 +09:00
ksmbd	ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate	2023-06-21 15:59:12 +02:00
lockd	lockd: set file_lock start and end when decoding nlm4 testargs	2023-03-30 12:47:56 +02:00
minix	minix: fix bug when opening a file with O_DIRECT	2022-04-13 20:59:10 +02:00
netfs	netfs: fix parameter of cleanup()	2021-12-29 12:28:59 +01:00
nfs	NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease	2023-05-11 23:00:36 +09:00
nfs_common
nfsd	NFSD: callback request does not use correct credential for AUTH_SYS	2023-04-13 16:48:19 +02:00
nilfs2	nilfs2: prevent general protection fault in nilfs_clear_dirty_page()	2023-06-28 10:29:45 +02:00
nls
notify	inotify: Avoid reporting event with invalid wd	2023-05-17 11:50:22 +02:00
ntfs	ntfs: check overflow when iterating ATTR_RECORDs	2022-11-26 09:24:52 +01:00
ntfs3	fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()	2023-05-24 17:36:47 +01:00
ocfs2	ocfs2: check new file size on fallocate call	2023-06-21 15:59:14 +02:00
omfs
openpromfs
orangefs	orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()	2022-12-31 13:14:44 +01:00
overlayfs	ovl: Use "buf" flexible array for memcpy() destination	2023-02-09 11:26:47 +01:00
proc	mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps	2023-02-09 11:26:44 +01:00
pstore	pstore: Revert pmsg_lock back to a normal mutex	2023-05-11 23:00:31 +09:00
qnx4
qnx6
quota	ext4: fix bug_on in __es_tree_search caused by bad quota inode	2023-01-12 11:59:01 +01:00
ramfs
reiserfs	reiserfs: Add security prefix to xattr name in reiserfs_security_write()	2023-05-11 23:00:17 +09:00
romfs
smbfs_common	cifs: Fix crash on unload of cifs_arc4.ko	2021-12-14 10:57:12 +01:00
squashfs	revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"	2023-02-22 12:57:07 +01:00
sysfs
sysv	fs: sysv: Fix sysv_nblocks() returns wrong value	2022-12-31 13:14:05 +01:00
tracefs	tracefs: Only clobber mode/uid/gid on remount if asked	2022-09-20 12:39:43 +02:00
ubifs	ubifs: Fix memory leak in do_rename	2023-05-17 11:50:14 +02:00
udf	udf: Fix off-by-one error when discarding preallocation	2023-03-17 08:48:50 +01:00
ufs
unicode
vboxsf
verity	fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY	2023-04-05 11:24:51 +02:00
xfs	xfs: verify buffer contents when we skip log replay	2023-06-14 11:13:09 +02:00
zonefs	zonefs: Fix error message in zonefs_file_dio_append()	2023-04-05 11:25:01 +02:00
aio.c	aio: fix mremap after fork null-deref	2023-02-22 12:57:05 +01:00
anon_inodes.c
attr.c	attr: use consistent sgid stripping checks	2023-03-17 08:49:01 +01:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c	fs/binfmt_elf: Fix memory leak in load_elf_binary()	2022-11-03 23:59:12 +09:00
binfmt_elf_fdpic.c	binfmt: Fix error return code in load_elf_fdpic_binary()	2023-01-12 11:58:46 +01:00
binfmt_flat.c	binfmt_flat: do not stop relocating GOT entries prematurely on riscv	2022-06-09 10:22:26 +02:00
binfmt_misc.c	binfmt_misc: fix shift-out-of-bounds in check_special_flags	2022-12-31 13:14:39 +01:00
binfmt_script.c
buffer.c	mm: fs: initialize fsdata passed to write_begin/write_end interface	2022-11-26 09:24:51 +01:00
char_dev.c	chardev: fix error handling in cdev_device_add()	2022-12-31 13:14:30 +01:00
compat_binfmt_elf.c
coredump.c	coredump: Use the vma snapshot in fill_files_note	2022-04-08 14:24:18 +02:00
d_path.c
dax.c	fsdax: Fix infinite loop in dax_iomap_rw()	2022-09-28 11:11:56 +02:00
dcache.c
direct-io.c
drop_caches.c
eventfd.c	eventfd: provide a eventfd_signal_mask() helper	2023-01-24 07:22:43 +01:00
eventpoll.c	epoll: ep_autoremove_wake_function should use list_del_init_careful	2023-06-21 15:59:14 +02:00
exec.c	exec: Copy oldsighand->action under spin-lock	2022-11-03 23:59:12 +09:00
fcntl.c
fhandle.c
file.c	fs: prevent out-of-bounds array speculation when closing a file descriptor	2023-03-17 08:48:47 +01:00
file_table.c	locks: fix TOCTOU race when granting write lease	2022-10-26 12:34:58 +02:00
filesystems.c
fs-writeback.c	writeback: fix call of incorrect macro	2023-05-17 11:50:16 +02:00
fs_context.c	vfs: fs_context: fix up param length parsing in legacy_parse_param	2022-01-20 09:13:14 +01:00
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fsopen.c
init.c
inode.c	attr: use consistent sgid stripping checks	2023-03-17 08:49:01 +01:00
internal.h	attr: use consistent sgid stripping checks	2023-03-17 08:49:01 +01:00
ioctl.c	fs: fix an infinite loop in iomap_fiemap	2022-05-25 09:57:26 +02:00
Kconfig
Kconfig.binfmt
kernel_read_file.c
libfs.c	libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value	2022-12-31 13:14:03 +01:00
locks.c	filelocks: use mount idmapping for setlease permission check	2023-03-17 08:49:02 +01:00
Makefile	io_uring: move to separate directory	2022-12-14 11:37:31 +01:00
mbcache.c	mbcache: Avoid nesting of cache->c_list_lock under bit locks	2023-01-12 11:59:20 +01:00
mount.h
mpage.c
namei.c	fs: move S_ISGID stripping into the vfs_*() helpers	2023-03-17 08:49:00 +01:00
namespace.c	fs: drop peer group ids under namespace lock	2023-04-13 16:48:25 +02:00
no-block.c
nsfs.c
open.c	attr: use consistent sgid stripping checks	2023-03-17 08:49:01 +01:00
pipe.c	pipe: Fix missing lock in pipe_resize_ring()	2022-06-06 08:43:37 +02:00
pnode.c	pnode: terminate at peers of source	2023-01-12 11:58:47 +01:00
pnode.h
posix_acl.c	fs: fix acl translation	2022-07-02 16:41:17 +02:00
proc_namespace.c	fs: add is_idmapped_mnt() helper	2022-07-02 16:41:14 +02:00
read_write.c	vfs: fix copy_file_range() averts filesystem freeze protection	2022-12-19 12:36:39 +01:00
readdir.c
remap_range.c	fs/remap: constrain dedupe of EOF blocks	2022-07-21 21:24:14 +02:00
select.c	select: Fix indefinitely sleeping task in poll_schedule_timeout()	2022-01-29 10:58:25 +01:00
seq_file.c	rxrpc: Fix locking issue	2022-07-12 16:35:08 +02:00
signalfd.c	signalfd: use wake_up_pollfree()	2021-12-14 10:57:15 +01:00
splice.c	Revert "fs: check FMODE_LSEEK to control internal pipe splicing"	2022-10-26 12:34:17 +02:00
stack.c
stat.c	stat: fix inconsistency between struct stat and struct compat_stat	2022-04-27 14:38:57 +02:00
statfs.c	statfs: enforce statfs[64] structure initialization	2023-05-24 17:36:54 +01:00
super.c	fscrypt: destroy keyring after security_sb_delete()	2023-03-30 12:47:56 +02:00
sync.c	vfs: make sync_filesystem return errors from ->sync_fs	2022-04-27 14:38:50 +02:00
timerfd.c
userfaultfd.c	userfaultfd: open userfaultfds with O_RDONLY	2022-10-26 12:34:36 +02:00
utimes.c
xattr.c	fs: don't audit the capability check in simple_xattr_list()	2022-12-31 13:14:01 +01:00