Thadeu Lima de Souza Cascardo 1c82587cb5 hfsplus: don't query the device logical block size multiple times ... Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size. Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized. Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096. The produced KASAN report before the fix looks like this: [ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0 [ 419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000 [ 419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000 [ 419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000 [ 419.978375] </TASK> [ 419.978589] Fixes: 6596528e39 ("hfsplus: ensure bio requests are not smaller than the hardware sectors") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Link: https://lore.kernel.org/r/20241107114109.839253-1-cascardo@igalia.com Signed-off-by: Christian Brauner <brauner@kernel.org>		2024-11-12 14:36:45 +01:00
..
9p	netfs: Speed up buffered reading	2024-09-12 12:20:41 +02:00
adfs	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
affs	affs-for-6.12-tag	2024-09-16 13:07:59 +02:00
afs	netfs: Speed up buffered reading	2024-09-12 12:20:41 +02:00
autofs	autofs: add per dentry expire timeout	2024-08-30 08:22:36 +02:00
bcachefs	bcachefs fixes for 6.11-rc1	2024-09-29 09:17:44 -07:00
befs	befs: Convert befs_symlink_read_folio() to use folio_end_read()	2024-05-31 12:31:39 +02:00
bfs	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
btrfs	fs/writeback: convert wbc_account_cgroup_owner to take a folio	2024-10-28 13:26:54 +01:00
cachefiles	cachefiles, netfs: Fix write to partial block at EOF	2024-09-12 12:20:41 +02:00
ceph	Three CephFS fixes from Xiubo and Luis and a bunch of assorted	2024-09-28 08:40:36 -07:00
coda	coda: use param->file for FSCONFIG_SET_FD	2024-08-19 13:45:03 +02:00
configfs	fs/configfs: Add a callback to determine attribute visibility	2024-06-17 20:42:57 +02:00
cramfs	vfs-6.11.module.description	2024-07-15 11:14:59 -07:00
crypto	The usual shower of singleton fixes and minor series all over MM,	2024-05-19 09:21:03 -07:00
debugfs	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
devpts
dlm	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
ecryptfs	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
efivarfs	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
efs	vfs-6.11.module.description	2024-07-15 11:14:59 -07:00
erofs	erofs: reject inodes with negative i_size	2024-09-12 23:00:09 +08:00
exfat	exfat: resolve memory leak from exfat_create_upcase_table()	2024-09-23 21:38:13 +09:00
exportfs	fhandle: relax open_by_handle_at() permission checks	2024-05-28 15:57:23 +02:00
ext2	vfs-6.12.file	2024-09-16 09:14:02 +02:00
ext4	fs/writeback: convert wbc_account_cgroup_owner to take a folio	2024-10-28 13:26:54 +01:00
f2fs	fs/writeback: convert wbc_account_cgroup_owner to take a folio	2024-10-28 13:26:54 +01:00
fat	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
freevxfs	freevxfs: Replace one-element array with flexible array member	2024-11-06 10:42:06 +01:00
fuse	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
gfs2	Merge patch series "Fixup NLM and kNFSD file lock callbacks"	2024-10-02 07:52:07 +02:00
hfs	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
hfsplus	hfsplus: don't query the device logical block size multiple times	2024-11-12 14:36:45 +01:00
hostfs	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
hpfs	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
hugetlbfs	Merge patch series "Introduce tracepoint for hugetlbfs"	2024-10-02 07:52:11 +02:00
iomap	fs/writeback: convert wbc_account_cgroup_owner to take a folio	2024-10-28 13:26:54 +01:00
isofs	isofs: Annotate struct SL_component with __counted_by()	2024-09-02 15:52:56 +02:00
jbd2	jbd2: remove unneeded check of ret in jbd2_fc_get_buf	2024-08-26 23:49:15 -04:00
jffs2	jffs2: Use a folio in jffs2_garbage_collect_dnode()	2024-08-19 13:40:00 +02:00
jfs	A few fixes for jfs	2024-09-19 06:38:43 +02:00
kernfs	kernfs: mount: Remove unnecessary ‘NULL’ values from knparent	2024-05-04 19:02:39 +02:00
lockd	Merge patch series "Fixup NLM and kNFSD file lock callbacks"	2024-10-02 07:52:07 +02:00
minix	buffer: Convert __block_write_begin() to take a folio	2024-08-07 11:33:36 +02:00
netfs	netfs: Fix write oops in generic/346 (9p) and generic/074 (cifs)	2024-09-26 17:45:20 -05:00
nfs	NFS Client Updates for Linux 6.12	2024-09-24 15:44:18 -07:00
nfs_common	nfs: add LOCALIO support	2024-09-23 15:03:30 -04:00
nfsd	Merge patch series "Fixup NLM and kNFSD file lock callbacks"	2024-10-02 07:52:07 +02:00
nilfs2	Many singleton patches - please see the various changelogs for details.	2024-09-21 08:20:50 -07:00
nls	fs: nls: add missing MODULE_DESCRIPTION() macros	2024-06-03 16:37:07 +02:00
notify	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
ntfs3	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
ocfs2	Merge patch series "Fixup NLM and kNFSD file lock callbacks"	2024-10-02 07:52:07 +02:00
omfs	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
openpromfs	openpromfs: add missing MODULE_DESCRIPTION() macro	2024-06-20 09:46:01 +02:00
orangefs	orangefs: Constify struct kobj_type	2024-09-20 19:34:00 -07:00
overlayfs	ovl: fix file leak in ovl_real_fdget_meta()	2024-09-27 12:38:47 -07:00
proc	Summary	2024-09-24 11:08:40 -07:00
pstore	drm next for 6.12-rc1	2024-09-19 10:18:15 +02:00
qnx4	qnx4: add MODULE_DESCRIPTION()	2024-05-28 11:52:53 +02:00
qnx6	qnx6: Convert directory handling to use kmap_local	2024-08-07 11:31:56 +02:00
quota	\n	2024-09-23 10:49:28 -07:00
ramfs	mm: switch mm->get_unmapped_area() to a flag	2024-04-25 20:56:25 -07:00
reiserfs	buffer: Convert __block_write_begin() to take a folio	2024-08-07 11:33:36 +02:00
romfs	romfs: fix romfs_read_folio()	2024-08-21 22:32:58 +02:00
smb	5 smb3 server fixes	2024-09-28 08:35:21 -07:00
squashfs	Many singleton patches - please see the various changelogs for details.	2024-09-21 08:20:50 -07:00
sysfs	Merge 6.9-rc5 into driver-core-next	2024-04-23 13:27:43 +02:00
sysv	buffer: Convert __block_write_begin() to take a folio	2024-08-07 11:33:36 +02:00
tests	execve: Move KUnit tests to tests/ subdirectory	2024-07-22 18:25:47 -07:00
tracefs	eventfs: Use list_del_rcu() for SRCU protected list variable	2024-09-05 10:18:48 -04:00
ubifs	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
udf	vfs-6.12.file	2024-09-16 09:14:02 +02:00
ufs	vfs-6.12.file	2024-09-16 09:14:02 +02:00
unicode	unicode: add MODULE_DESCRIPTION() macros	2024-06-20 19:30:02 -04:00
vboxsf	fs: Convert aops->write_end to take a folio	2024-08-07 11:32:02 +02:00
verity	fsverity: expose verified fsverity built-in signatures to LSMs	2024-08-20 14:03:18 -04:00
xfs	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
zonefs	iomap: add a private argument for iomap_file_buffered_write	2024-09-03 15:01:23 +02:00
aio.c	fs/aio: Fix __percpu annotation of *cpu pointer in struct kioctx	2024-08-19 13:45:03 +02:00
anon_inodes.c	fs: Create anon_inode_getfile_fmode()	2024-04-26 10:33:05 +02:00
attr.c	nfsd-6.11 fixes:	2024-08-29 06:20:44 +12:00
backing-file.c	backing-file: convert to using fops->splice_write	2024-08-23 13:08:31 +02:00
bad_inode.c
binfmt_elf_fdpic.c	binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined	2024-08-26 13:00:38 -07:00
binfmt_elf.c	Revert "binfmt_elf, coredump: Log the reason of the failed core dumps"	2024-09-26 11:39:02 -07:00
binfmt_flat.c	binfmt_flat: Fix corruption when not offsetting data start	2024-08-09 20:19:00 -07:00
binfmt_misc.c	vfs-6.11.module.description	2024-07-15 11:14:59 -07:00
binfmt_script.c	fs: binfmt: add missing MODULE_DESCRIPTION() macros	2024-05-28 12:06:51 +02:00
bpf_fs_kfuncs.c	bpf: Add kfunc bpf_get_dentry_xattr() to read xattr from dentry	2024-08-07 11:26:54 -07:00
buffer.c	fs/writeback: convert wbc_account_cgroup_owner to take a folio	2024-10-28 13:26:54 +01:00
char_dev.c	fs: Reorganize kerneldoc parameter names	2024-10-22 11:16:57 +02:00
compat_binfmt_elf.c
coredump.c	coredump: add cond_resched() to dump_user_range	2024-10-22 11:16:58 +02:00
d_path.c
dax.c	dax: use huge_zero_folio	2024-04-25 20:56:20 -07:00
dcache.c	fs: Reorganize kerneldoc parameter names	2024-10-22 11:16:57 +02:00
direct-io.c	fs/direct-io: Remove linux/prefetch.h include	2024-08-19 13:45:02 +02:00
drop_caches.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
eventfd.c	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00
eventpoll.c	epoll: Add synchronous wakeup support for ep_poll_callback	2024-10-22 11:16:59 +02:00
exec.c	ALong with the usual shower of singleton patches, notable patch series in	2024-09-21 07:29:05 -07:00
fcntl.c	fcntl: make F_DUPFD_QUERY associative	2024-10-22 11:16:58 +02:00
fhandle.c	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
file_table.c	slab updates for 6.12	2024-09-18 08:53:53 +02:00
file.c	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
filesystems.c
fs_context.c
fs_parser.c	fs: support relative paths with FSCONFIG_SET_STRING	2024-10-02 07:52:33 +02:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	fs/writeback: convert wbc_account_cgroup_owner to take a folio	2024-10-28 13:26:54 +01:00
fsopen.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
init.c
inode.c	fs/inode: Fix a typo	2024-10-22 11:16:58 +02:00
internal.h	file: reclaim 24 bytes from f_owner	2024-08-28 13:05:39 +02:00
ioctl.c	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00
Kconfig	NFS Client Updates for Linux 6.12	2024-09-24 15:44:18 -07:00
Kconfig.binfmt	exec: Add KUnit test for bprm_stack_limits()	2024-06-19 13:13:55 -07:00
kernel_read_file.c	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00
libfs.c	vfs-6.12.folio	2024-09-16 08:54:30 +02:00
locks.c	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
Makefile	bpf: introduce new VFS based BPF kfuncs	2024-08-06 09:01:41 -07:00
mbcache.c	vfs: remove SLAB_MEM_SPREAD flag usage	2024-02-27 11:21:31 +01:00
mnt_idmapping.c	fuse update for 6.12	2024-09-24 15:29:42 -07:00
mount.h	vfs-6.12.mount	2024-09-16 11:15:26 +02:00
mpage.c	fs/writeback: convert wbc_account_cgroup_owner to take a folio	2024-10-28 13:26:54 +01:00
namei.c	fs: optimize acl_permission_check()	2024-11-01 14:12:34 +01:00
namespace.c	namespace: Use atomic64_inc_return() in alloc_mnt_ns()	2024-10-22 11:16:57 +02:00
nsfs.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
open.c	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
pidfs.c	pidfs: handle kernels without namespaces cleanly	2024-07-24 10:53:13 +02:00
pipe.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
pnode.c
pnode.h
posix_acl.c	acl: Annotate struct posix_acl with __counted_by()	2024-10-22 11:16:59 +02:00
proc_namespace.c	fs: rename show_mnt_opts -> show_vfsmnt_opts	2024-06-28 14:36:43 +02:00
read_write.c	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
readdir.c	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00
remap_range.c	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00
select.c	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
seq_file.c	fs: Reorganize kerneldoc parameter names	2024-10-22 11:16:57 +02:00
signalfd.c	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
splice.c	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00
stack.c
stat.c	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00
statfs.c	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00
super.c	vfs-6.12.misc	2024-09-16 08:35:09 +02:00
sync.c	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00
sysctls.c
timerfd.c	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00
userfaultfd.c	mm/hugetlb: remove hugetlb_follow_page_mask() leftover	2024-09-01 20:25:57 -07:00
utimes.c	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00
xattr.c	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00