Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-06 05:06:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
7f0b3524a6
linux-stable/fs/ocfs2
History
Dmitry Antipov dc78efe556 ocfs2: fix uninitialized value in ocfs2_file_read_iter() 
[ Upstream commit adc77b19f6 ]

Syzbot has reported the following KMSAN splat:

BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80
 ocfs2_file_read_iter+0x9a4/0xf80
 __io_read+0x8d4/0x20f0
 io_read+0x3e/0xf0
 io_issue_sqe+0x42b/0x22c0
 io_wq_submit_work+0xaf9/0xdc0
 io_worker_handle_work+0xd13/0x2110
 io_wq_worker+0x447/0x1410
 ret_from_fork+0x6f/0x90
 ret_from_fork_asm+0x1a/0x30

Uninit was created at:
 __alloc_pages_noprof+0x9a7/0xe00
 alloc_pages_mpol_noprof+0x299/0x990
 alloc_pages_noprof+0x1bf/0x1e0
 allocate_slab+0x33a/0x1250
 ___slab_alloc+0x12ef/0x35e0
 kmem_cache_alloc_bulk_noprof+0x486/0x1330
 __io_alloc_req_refill+0x84/0x560
 io_submit_sqes+0x172f/0x2f30
 __se_sys_io_uring_enter+0x406/0x41c0
 __x64_sys_io_uring_enter+0x11f/0x1a0
 x64_sys_call+0x2b54/0x3ba0
 do_syscall_64+0xcd/0x1e0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Since an instance of 'struct kiocb' may be passed from the block layer
with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()'
and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in
'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'.

Link: https://lkml.kernel.org/r/20241029091736.1501946-1-dmantipov@yandex.ru
Fixes: 7cdfc3a1c3 ("ocfs2: Remember rw lock level during direct io")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Reported-by: syzbot+a73e253cca4f0230a5a5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a73e253cca4f0230a5a5
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Joseph Qi <jiangqi903@gmail.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-12-05 14:02:13 +01:00
..
cluster introduce fd_file(), convert all accessors to it. 2024-08-12 22:00:43 -04:00
dlm ocfs2: remove redundant assignment to variable status 2024-05-08 08:41:27 -07:00
dlmfs ocfs2: remove SLAB_MEM_SPREAD flag usage 2024-03-14 09:17:29 -07:00
acl.c ocfs2: convert to new timestamp accessors 2023-10-18 14:08:24 +02:00
acl.h fs: port ->set_acl() to pass mnt_idmap 2023-01-19 09:24:27 +01:00
alloc.c fs: convert block_write_full_page to block_write_full_folio 2023-12-29 11:58:35 -08:00
alloc.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
aops.c ocfs2: fix uninit-value in ocfs2_get_block() 2024-09-26 14:01:45 -07:00
aops.h ocfs2: fix uninitialized value in ocfs2_file_read_iter() 2024-12-05 14:02:13 +01:00
blockcheck.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
blockcheck.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
buffer_head_io.c ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate 2024-09-09 15:15:54 -07:00
buffer_head_io.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dcache.c ocfs2_find_match(): there's no such thing as NULL or negative ->d_parent 2023-12-21 12:53:30 -05:00
dcache.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dir.c Many singleton patches - please see the various changelogs for details. 2024-09-21 08:20:50 -07:00
dir.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dlmglue.c ocfs2: use max() to improve ocfs2_dlm_seq_show() 2024-09-01 20:43:38 -07:00
dlmglue.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
export.c ocfs2: fix sparse warnings 2024-04-25 21:07:04 -07:00
export.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
extent_map.c ocfs2: fix deadlock in ocfs2_get_system_file_inode 2024-09-26 14:01:44 -07:00
extent_map.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
file.c ocfs2: fix uninitialized value in ocfs2_file_read_iter() 2024-12-05 14:02:13 +01:00
file.h ocfs2: store cookie in private data 2024-09-12 11:58:44 +02:00
filecheck.c ocfs2: use default_groups in kobj_type 2022-01-15 16:30:24 +02:00
filecheck.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
heartbeat.c ocfs2: fix a typo in a comment 2022-07-29 18:12:36 -07:00
heartbeat.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
inode.c ocfs2: fix sparse warnings 2024-04-25 21:07:04 -07:00
inode.h quota: Properly annotate i_dquot arrays with __rcu 2024-02-08 12:04:59 +01:00
ioctl.c ocfs2: update inode ctime in ocfs2_fileattr_set 2024-04-25 21:07:01 -07:00
ioctl.h fs: port ->fileattr_set() to pass mnt_idmap 2023-01-19 09:24:27 +01:00
journal.c ocfs2: fix null-ptr-deref when journal load failed. 2024-09-09 15:15:53 -07:00
journal.h ocfs2: fix DIO failure due to insufficient transaction credits 2024-06-24 20:52:10 -07:00
Kconfig fs: add CONFIG_BUFFER_HEAD 2023-08-02 09:13:09 -06:00
localalloc.c ocfs2: fix the la space leak when unmounting an ocfs2 volume 2024-09-01 20:43:23 -07:00
localalloc.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
locks.c ocfs2: adapt to breakup of struct file_lock 2024-02-05 13:11:43 +01:00
locks.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
Makefile ocfs2: improve ocfs2 Makefile 2018-12-28 12:11:45 -08:00
mmap.c fs: Convert aops->write_begin to take a folio 2024-08-07 11:33:21 +02:00
mmap.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
move_extents.c ocfs2: improve write IO performance when fragmentation is high 2024-04-25 21:07:03 -07:00
move_extents.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
namei.c fs: add kernel-doc comments to ocfs2_prepare_orphan_dir() 2024-07-04 23:43:10 -07:00
namei.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs1_fs_compat.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2_fs.h ocfs2: improve write IO performance when fragmentation is high 2024-04-25 21:07:03 -07:00
ocfs2_ioctl.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2_lockid.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2_lockingver.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2_trace.h ocfs2: fix DIO failure due to insufficient transaction credits 2024-06-24 20:52:10 -07:00
ocfs2.h ocfs2: constify struct ocfs2_lock_res_ops 2024-06-24 22:25:10 -07:00
quota_global.c ocfs2: cleanup return value and mlog in ocfs2_global_read_info() 2024-09-09 16:47:43 -07:00
quota_local.c ocfs2: cancel dqi_sync_work before freeing oinfo 2024-09-09 15:15:54 -07:00
quota.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
refcounttree.c ocfs2: reserve space for inline xattr before attaching reflink tree 2024-09-26 14:01:44 -07:00
refcounttree.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
reservations.c ocfs2: correctly use ocfs2_find_next_zero_bit() 2024-04-25 21:07:01 -07:00
reservations.h ocfs2: change return type of ocfs2_resmap_init 2022-04-29 14:37:58 -07:00
resize.c ocfs2: uncache inode which has failed entering the group 2024-11-14 22:43:48 -08:00
resize.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
slot_map.c ocfs2: Annotate struct ocfs2_slot_info with __counted_by 2023-10-02 09:48:52 -07:00
slot_map.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
stack_o2cb.c ocfs2: constify struct ocfs2_stack_operations 2024-06-24 22:25:10 -07:00
stack_user.c ocfs2: constify struct ocfs2_stack_operations 2024-06-24 22:25:10 -07:00
stackglue.c fs: Remove the now superfluous sentinel elements from ctl_table array 2023-12-28 04:57:57 -08:00
stackglue.h ocfs2: constify struct ocfs2_stack_operations 2024-06-24 22:25:10 -07:00
suballoc.c ocfs2: speed up chain-list searching 2024-04-25 21:07:04 -07:00
suballoc.h ocfs2: improve write IO performance when fragmentation is high 2024-04-25 21:07:03 -07:00
super.c ocfs2: fix UBSAN warning in ocfs2_verify_volume() 2024-11-11 17:20:23 -08:00
super.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
symlink.c ocfs2: Convert ocfs2 to read_folio 2022-05-09 16:21:46 -04:00
symlink.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
sysfile.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
sysfile.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
uptodate.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
uptodate.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
xattr.c ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() 2024-11-07 14:14:59 -08:00
xattr.h ocfs2: move ocfs2_xattr_handlers and ocfs2_xattr_handler_map to .rodata 2023-10-09 16:24:20 +02:00