mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2024-12-28 16:53:49 +00:00
adc77b19f6
Syzbot has reported the following KMSAN splat:
BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80
ocfs2_file_read_iter+0x9a4/0xf80
__io_read+0x8d4/0x20f0
io_read+0x3e/0xf0
io_issue_sqe+0x42b/0x22c0
io_wq_submit_work+0xaf9/0xdc0
io_worker_handle_work+0xd13/0x2110
io_wq_worker+0x447/0x1410
ret_from_fork+0x6f/0x90
ret_from_fork_asm+0x1a/0x30
Uninit was created at:
__alloc_pages_noprof+0x9a7/0xe00
alloc_pages_mpol_noprof+0x299/0x990
alloc_pages_noprof+0x1bf/0x1e0
allocate_slab+0x33a/0x1250
___slab_alloc+0x12ef/0x35e0
kmem_cache_alloc_bulk_noprof+0x486/0x1330
__io_alloc_req_refill+0x84/0x560
io_submit_sqes+0x172f/0x2f30
__se_sys_io_uring_enter+0x406/0x41c0
__x64_sys_io_uring_enter+0x11f/0x1a0
x64_sys_call+0x2b54/0x3ba0
do_syscall_64+0xcd/0x1e0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Since an instance of 'struct kiocb' may be passed from the block layer
with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()'
and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in
'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'.
Link: https://lkml.kernel.org/r/20241029091736.1501946-1-dmantipov@yandex.ru
Fixes: 7cdfc3a1c3 ("ocfs2: Remember rw lock level during direct io")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Reported-by: syzbot+a73e253cca4f0230a5a5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a73e253cca4f0230a5a5
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Joseph Qi <jiangqi903@gmail.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
81 lines
2.4 KiB
C
81 lines
2.4 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* Copyright (C) 2002, 2004, 2005 Oracle. All rights reserved.
|
|
*/
|
|
|
|
#ifndef OCFS2_AOPS_H
|
|
#define OCFS2_AOPS_H
|
|
|
|
#include <linux/fs.h>
|
|
|
|
handle_t *ocfs2_start_walk_page_trans(struct inode *inode,
|
|
struct page *page,
|
|
unsigned from,
|
|
unsigned to);
|
|
|
|
int ocfs2_map_page_blocks(struct page *page, u64 *p_blkno,
|
|
struct inode *inode, unsigned int from,
|
|
unsigned int to, int new);
|
|
|
|
void ocfs2_unlock_and_free_pages(struct page **pages, int num_pages);
|
|
|
|
int walk_page_buffers( handle_t *handle,
|
|
struct buffer_head *head,
|
|
unsigned from,
|
|
unsigned to,
|
|
int *partial,
|
|
int (*fn)( handle_t *handle,
|
|
struct buffer_head *bh));
|
|
|
|
int ocfs2_write_end_nolock(struct address_space *mapping,
|
|
loff_t pos, unsigned len, unsigned copied, void *fsdata);
|
|
|
|
typedef enum {
|
|
OCFS2_WRITE_BUFFER = 0,
|
|
OCFS2_WRITE_DIRECT,
|
|
OCFS2_WRITE_MMAP,
|
|
} ocfs2_write_type_t;
|
|
|
|
int ocfs2_write_begin_nolock(struct address_space *mapping,
|
|
loff_t pos, unsigned len, ocfs2_write_type_t type,
|
|
struct folio **foliop, void **fsdata,
|
|
struct buffer_head *di_bh, struct page *mmap_page);
|
|
|
|
int ocfs2_read_inline_data(struct inode *inode, struct page *page,
|
|
struct buffer_head *di_bh);
|
|
int ocfs2_size_fits_inline_data(struct buffer_head *di_bh, u64 new_size);
|
|
|
|
int ocfs2_get_block(struct inode *inode, sector_t iblock,
|
|
struct buffer_head *bh_result, int create);
|
|
/* all ocfs2_dio_end_io()'s fault */
|
|
#define ocfs2_iocb_is_rw_locked(iocb) \
|
|
test_bit(0, (unsigned long *)&iocb->private)
|
|
static inline void ocfs2_iocb_set_rw_locked(struct kiocb *iocb, int level)
|
|
{
|
|
set_bit(0, (unsigned long *)&iocb->private);
|
|
if (level)
|
|
set_bit(1, (unsigned long *)&iocb->private);
|
|
else
|
|
clear_bit(1, (unsigned long *)&iocb->private);
|
|
}
|
|
|
|
/*
|
|
* Using a named enum representing lock types in terms of #N bit stored in
|
|
* iocb->private, which is going to be used for communication between
|
|
* ocfs2_dio_end_io() and ocfs2_file_write/read_iter().
|
|
*/
|
|
enum ocfs2_iocb_lock_bits {
|
|
OCFS2_IOCB_RW_LOCK = 0,
|
|
OCFS2_IOCB_RW_LOCK_LEVEL,
|
|
OCFS2_IOCB_NUM_LOCKS
|
|
};
|
|
|
|
#define ocfs2_iocb_init_rw_locked(iocb) \
|
|
(iocb->private = NULL)
|
|
#define ocfs2_iocb_clear_rw_locked(iocb) \
|
|
clear_bit(OCFS2_IOCB_RW_LOCK, (unsigned long *)&iocb->private)
|
|
#define ocfs2_iocb_rw_locked_level(iocb) \
|
|
test_bit(OCFS2_IOCB_RW_LOCK_LEVEL, (unsigned long *)&iocb->private)
|
|
|
|
#endif /* OCFS2_FILE_H */
|