Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-16 18:08:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
linux/fs
History
Luís Henriques 29a5b8a137 ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 
When walking through an inode extents, the ext4_ext_binsearch_idx() function
assumes that the extent header has been previously validated.  However, there
are no checks that verify that the number of entries (eh->eh_entries) is
non-zero when depth is > 0.  And this will lead to problems because the
EXT_FIRST_INDEX() and EXT_LAST_INDEX() will return garbage and result in this:

[  135.245946] ------------[ cut here ]------------
[  135.247579] kernel BUG at fs/ext4/extents.c:2258!
[  135.249045] invalid opcode: 0000 [#1] PREEMPT SMP
[  135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4
[  135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014
[  135.255065] RIP: 0010:ext4_ext_map_blocks+0xc20/0xcb0
[  135.256475] Code:
[  135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246
[  135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023
[  135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000003 RDI: ffff8880046e922c
[  135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c
[  135.268576] R10: 0000000000002602 R11: 0000000000000000 R12: 0000000000000024
[  135.270477] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000
[  135.272394] FS:  00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000
[  135.274510] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  135.276075] CR2: 00007ffc26bd4f00 CR3: 0000000006261004 CR4: 0000000000170ea0
[  135.277952] Call Trace:
[  135.278635]  <TASK>
[  135.279247]  ? preempt_count_add+0x6d/0xa0
[  135.280358]  ? percpu_counter_add_batch+0x55/0xb0
[  135.281612]  ? _raw_read_unlock+0x18/0x30
[  135.282704]  ext4_map_blocks+0x294/0x5a0
[  135.283745]  ? xa_load+0x6f/0xa0
[  135.284562]  ext4_mpage_readpages+0x3d6/0x770
[  135.285646]  read_pages+0x67/0x1d0
[  135.286492]  ? folio_add_lru+0x51/0x80
[  135.287441]  page_cache_ra_unbounded+0x124/0x170
[  135.288510]  filemap_get_pages+0x23d/0x5a0
[  135.289457]  ? path_openat+0xa72/0xdd0
[  135.290332]  filemap_read+0xbf/0x300
[  135.291158]  ? _raw_spin_lock_irqsave+0x17/0x40
[  135.292192]  new_sync_read+0x103/0x170
[  135.293014]  vfs_read+0x15d/0x180
[  135.293745]  ksys_read+0xa1/0xe0
[  135.294461]  do_syscall_64+0x3c/0x80
[  135.295284]  entry_SYSCALL_64_after_hwframe+0x46/0xb0

This patch simply adds an extra check in __ext4_ext_check(), verifying that
eh_entries is not 0 when eh_depth is > 0.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=215941
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216283
Cc: Baokun Li <libaokun1@huawei.com>
Cc: stable@kernel.org
Signed-off-by: Luís Henriques <lhenriques@suse.de>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Link: https://lore.kernel.org/r/20220822094235.2690-1-lhenriques@suse.de
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
2022-09-22 10:50:54 -04:00
..
9p
9p: Fix some kernel-doc comments
2022-07-02 18:52:21 +09:00
adfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
affs
affs: use memcpy_to_page and remove replace kmap_atomic()
2022-08-01 19:53:31 +02:00
afs
afs: Enable multipage folio support
2022-08-13 17:20:51 -07:00
autofs
autofs: remove unused ino field inode
2022-07-17 17:31:42 -07:00
befs
befs: Convert befs_symlink_read_folio() to use a folio
2022-08-02 12:34:03 -04:00
bfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
btrfs
for-6.0-rc3-tag
2022-08-28 10:44:04 -07:00
cachefiles
cachefiles: make on-demand request distribution fairer
2022-08-31 16:41:10 +01:00
ceph
We have a good pile of various fixes and cleanups from Xiubo, Jeff,
2022-08-11 12:41:07 -07:00
cifs
cifs: fix small mempool leak in SMB2_negotiate()
2022-08-30 20:08:13 -05:00
coda
coda: Convert coda_symlink_filler() to use a folio
2022-08-02 12:34:03 -04:00
configfs
configfs: fix a race in configfs_{,un}register_subsystem()
2022-02-22 18:30:28 +01:00
cramfs
cramfs: read_mapping_page() is synchronous
2022-08-02 12:34:02 -04:00
crypto
We have a good pile of various fixes and cleanups from Xiubo, Jeff,
2022-08-11 12:41:07 -07:00
debugfs
debugfs: Document that debugfs_create functions need not be error checked
2022-02-25 11:56:13 +01:00
devpts
fsnotify: fix fsnotify hooks in pseudo filesystems
2022-01-24 14:17:02 +01:00
dlm
fs: dlm: move kref_put assert for lkb structs
2022-08-01 09:31:46 -05:00
ecryptfs
ecryptfs: Convert ecryptfs to read_folio
2022-05-09 16:21:45 -04:00
efivarfs
efi: vars: Move efivar caching layer into efivarfs
2022-06-24 20:40:19 +02:00
efs
efs: Convert efs symlinks to read_folio
2022-05-09 16:21:45 -04:00
erofs
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
exfat
exfat: Drop superfluous new line for error messages
2022-08-01 10:14:07 +09:00
exportfs
exportfs: support idmapped mounts
2022-04-28 16:31:10 +02:00
ext2
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
ext4
ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0
2022-09-22 10:50:54 -04:00
f2fs
f2fs-for-6.0
2022-08-08 11:18:31 -07:00
fat
Updates to various subsystems which I help look after. lib, ocfs2,
2022-08-07 10:03:24 -07:00
freevxfs
freevxfs: Convert vxfs_immed_read_folio() to use a folio
2022-08-02 12:34:03 -04:00
fscache
fscache: add tracepoint when failing cookie
2022-08-09 14:13:59 +01:00
fuse
iov_iter stuff, part 2, rebased
2022-08-08 20:04:35 -07:00
gfs2
New code for 6.0:
2022-08-11 13:11:49 -07:00
hfs
hfs: Remove check for PageError
2022-06-29 08:51:06 -04:00
hfsplus
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
hostfs
hostfs: Handle page write errors correctly
2022-08-02 12:34:02 -04:00
hpfs
hpfs: Convert symlinks to read_folio
2022-05-09 16:21:45 -04:00
hugetlbfs
iov_iter stuff, part 2, rebased
2022-08-08 20:04:35 -07:00
iomap
New code for 6.0:
2022-08-11 13:11:49 -07:00
isofs
fs/buffer: Combine two submit_bh() and ll_rw_block() arguments
2022-07-14 12:14:32 -06:00
jbd2
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
jffs2
This pull request contains fixes for JFFS2, UBI and UBIFS
2022-06-03 14:42:24 -07:00
jfs
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
kernfs
kernfs: Fix typo 'the the' in comment
2022-07-28 10:57:25 +02:00
ksmbd
ksmbd: don't remove dos attribute xattr on O_TRUNC open
2022-08-15 21:07:01 -05:00
lockd
lockd: detect and reject lock arguments that overflow
2022-08-04 10:28:48 -04:00
minix
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
netfs
netfs: do not unlock and put the folio twice
2022-07-14 10:10:12 +02:00
nfs
NFS client bugfixes for Linux 6.0
2022-08-22 11:40:01 -07:00
nfs_common
…
nfsd
NFSD 6.0 Release Notes
2022-08-09 14:56:49 -07:00
nilfs2
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
nls
…
notify
fsnotify: Fix comment typo
2022-07-26 13:38:47 +02:00
ntfs
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
ntfs3
fs.idmapped.fixes.v6.0-rc3
2022-08-22 11:33:02 -07:00
ocfs2
ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown
2022-08-28 14:02:45 -07:00
omfs
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
openpromfs
fs: allocate inode by using alloc_inode_sb()
2022-03-22 15:57:03 -07:00
orangefs
orangefs: Remove test for folio error
2022-06-29 08:51:07 -04:00
overlayfs
acl: handle idmapped mounts for idmapped filesystems
2022-08-17 11:23:31 +02:00
proc
mm/smaps: don't access young/dirty bit if pte unpresent
2022-08-20 15:17:45 -07:00
pstore
EFI updates for v5.20
2022-08-03 14:38:02 -07:00
qnx4
fs: Convert block_read_full_page() to block_read_full_folio()
2022-05-09 16:21:44 -04:00
qnx6
fs: Convert mpage_readpage to mpage_read_folio
2022-05-09 16:21:44 -04:00
quota
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
ramfs
…
reiserfs
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
romfs
romfs: Convert romfs to read_folio
2022-05-09 16:21:46 -04:00
smbfs_common
Add various fsctl structs
2022-05-23 20:24:12 -05:00
squashfs
squashfs: don't call kmalloc in decompressors
2022-08-28 14:02:45 -07:00
sysfs
kobject: kobj_type: remove default_attrs
2022-04-05 15:39:19 +02:00
sysv
Not a lot of material this cycle. Many singleton patches against various
2022-05-27 11:22:03 -07:00
tracefs
tracefs: Fix syntax errors in comments
2022-06-17 19:01:28 -04:00
ubifs
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
udf
fs/buffer: Combine two submit_bh() and ll_rw_block() arguments
2022-07-14 12:14:32 -06:00
ufs
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
unicode
kbuild: unify cmd_copy and cmd_shipped
2022-02-14 10:37:32 +09:00
vboxsf
vboxsf: Convert vboxsf to read_folio
2022-05-09 16:21:46 -04:00
verity
fs-verity: mention btrfs support
2022-07-15 23:42:30 -07:00
xfs
New code for 6.0:
2022-08-13 13:50:11 -07:00
zonefs
New code for 6.0:
2022-08-11 13:11:49 -07:00
aio.c
iov_iter work, part 1 - isolated cleanups and optimizations.
2022-08-03 13:50:22 -07:00
anon_inodes.c
…
attr.c
vfs: Check the truncate maximum size in inode_newsize_ok()
2022-08-08 10:39:29 -07:00
bad_inode.c
…
binfmt_aout.c
…
binfmt_elf_fdpic.c
coredump: Snapshot the vmas in do_coredump
2022-03-08 12:55:29 -06:00
binfmt_elf_test.c
binfmt_elf: Introduce KUnit test
2022-03-03 20:38:56 -08:00
binfmt_elf.c
revert "fs/binfmt_elf: use PT_LOAD p_align values for static PIE"
2022-04-15 14:49:56 -07:00
binfmt_flat.c
binfmt_flat: Remove shared library support
2022-04-22 10:57:18 -07:00
binfmt_misc.c
Fix regression due to "fs: move binfmt_misc sysctl to its own file"
2022-02-09 09:50:02 -08:00
binfmt_script.c
…
buffer.c
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
char_dev.c
…
compat_binfmt_elf.c
binfmt_elf: Introduce KUnit test
2022-03-03 20:38:56 -08:00
coredump.c
fs: do not compare against ->llseek
2022-07-16 09:19:15 -04:00
d_path.c
…
dax.c
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
dcache.c
dcache: move the DCACHE_OP_COMPARE case out of the __d_lookup_rcu loop
2022-08-17 14:33:03 -07:00
direct-io.c
iov_iter: advancing variants of iov_iter_get_pages{,_alloc}()
2022-08-08 22:37:22 -04:00
drop_caches.c
…
eventfd.c
…
eventpoll.c
epoll: autoremove wakers even more aggressively
2022-07-17 17:31:40 -07:00
exec.c
execve fix for v6.0-rc2
2022-08-19 14:02:24 -07:00
fcntl.c
keep iocb_flags() result cached in struct file
2022-06-10 16:10:23 -04:00
fhandle.c
…
file_table.c
iov_iter work, part 1 - isolated cleanups and optimizations.
2022-08-03 13:50:22 -07:00
file.c
fix the breakage in close_fd_get_file() calling conventions change
2022-06-05 15:03:03 -04:00
filesystems.c
…
fs_context.c
vfs: fs_context: fix up param length parsing in legacy_parse_param
2022-01-18 09:23:19 +02:00
fs_parser.c
fs_parse: allow parameter value to be empty
2021-12-09 14:09:36 -05:00
fs_pin.c
…
fs_struct.c
…
fs_types.c
…
fs-writeback.c
writeback: avoid use-after-free after removing device
2022-08-28 14:02:43 -07:00
fsopen.c
uninline may_mount() and don't opencode it in fspick(2)/fsopen(2)
2022-05-19 23:25:10 -04:00
init.c
…
inode.c
fs: __file_remove_privs(): restore call to inode_has_no_xattr()
2022-08-18 09:39:33 +02:00
internal.h
Cleanups (and one fix) around struct mount handling.
2022-06-04 19:00:05 -07:00
ioctl.c
Fixes for 5.18-rc1:
2022-04-01 19:35:56 -07:00
Kconfig
mm: hugetlb_vmemmap: introduce the name HVO
2022-08-08 18:06:42 -07:00
Kconfig.binfmt
m68knommu: changes for linux 5.19
2022-05-30 10:56:18 -07:00
kernel_read_file.c
fs/kernel_read_file: allow to read files up-to ssize_t
2022-06-16 19:58:21 -07:00
libfs.c
fs: Convert simple_readpage to simple_read_folio
2022-05-09 16:21:44 -04:00
locks.c
locks: Fix dropped call to ->fl_release_private()
2022-08-17 15:08:58 -04:00
Makefile
io_uring: move to separate directory
2022-07-24 18:39:10 -06:00
mbcache.c
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
mount.h
switch try_to_unlazy_next() to __legitimize_mnt()
2022-07-05 16:18:21 -04:00
mpage.c
Folio changes for 6.0
2022-08-03 10:35:43 -07:00
namei.c
fs.setgid.v6.0
2022-08-09 09:52:28 -07:00
namespace.c
fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts
2022-08-17 11:27:11 +02:00
no-block.c
…
nsfs.c
…
open.c
iov_iter work, part 1 - isolated cleanups and optimizations.
2022-08-03 13:50:22 -07:00
pipe.c
Not a lot of material this cycle. Many singleton patches against various
2022-05-27 11:22:03 -07:00
pnode.c
…
pnode.h
…
posix_acl.c
acl: handle idmapped mounts for idmapped filesystems
2022-08-17 11:23:31 +02:00
proc_namespace.c
vfs: escape hash as well
2022-06-28 13:58:05 -04:00
read_write.c
switch new_sync_{read,write}() to ITER_UBUF
2022-08-08 22:37:15 -04:00
readdir.c
…
remap_range.c
- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe
2022-08-05 16:32:45 -07:00
select.c
select: Fix indefinitely sleeping task in poll_schedule_timeout()
2022-01-11 09:03:05 -08:00
seq_file.c
rxrpc: Fix locking issue
2022-05-22 21:03:01 +01:00
signalfd.c
Merge branch 'signal-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2022-01-17 05:49:30 +02:00
splice.c
iter_to_pipe(): switch to advancing variant of iov_iter_get_pages()
2022-08-08 22:37:23 -04:00
stack.c
…
stat.c
RISC-V Patches for the 5.19 Merge Window, Part 1
2022-05-31 14:10:54 -07:00
statfs.c
…
super.c
fuse update for 6.0
2022-08-08 11:10:02 -07:00
sync.c
riscv: compat: syscall: Add compat_sys_call_table implementation
2022-04-26 13:36:25 -07:00
sysctls.c
fs: move namespace sysctls and declare fs base directory
2022-01-22 08:33:36 +02:00
timerfd.c
…
userfaultfd.c
mm/uffd: reset write protection when unregister with wp-mode
2022-08-20 15:17:45 -07:00
utimes.c
…
xattr.c
acl: move idmapped mount fixup into vfs_{g,s}etxattr()
2022-07-15 22:08:59 +02:00