2018-09-04 15:46:30 -07:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
2021-11-08 18:35:01 -08:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2016-05-23 16:23:09 -07:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-05-25 02:47:14 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
2010-07-10 16:50:41 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2010-07-10 16:50:41 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-12-06 15:43:56 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2010-07-13 23:33:51 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-05-25 02:47:14 +09:00
|
|
|
|
2016-05-23 16:23:39 -07:00
|
|
|
|
2009-05-25 02:47:14 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-12-06 15:43:56 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-05-25 02:47:14 +09:00
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
|
|
|
|
|
2009-05-25 02:47:14 +09:00
|
|
|
|
|
|
|
|
|
nilfs2: fix failure to detect DAT corruption in btree and direct mappings
Patch series "nilfs2: fix kernel bug at submit_bh_wbc()".
This resolves a kernel BUG reported by syzbot. Since there are two
flaws involved, I've made each one a separate patch.
The first patch alone resolves the syzbot-reported bug, but I think
both fixes should be sent to stable, so I've tagged them as such.
This patch (of 2):
Syzbot has reported a kernel bug in submit_bh_wbc() when writing file data
to a nilfs2 file system whose metadata is corrupted.
There are two flaws involved in this issue.
The first flaw is that when nilfs_get_block() locates a data block using
btree or direct mapping, if the disk address translation routine
nilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata
corruption, it can be passed back to nilfs_get_block(). This causes
nilfs_get_block() to misidentify an existing block as non-existent,
causing both data block lookup and insertion to fail inconsistently.
The second flaw is that nilfs_get_block() returns a successful status in
this inconsistent state. This causes the caller __block_write_begin_int()
or others to request a read even though the buffer is not mapped,
resulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc()
failing.
This fixes the first issue by changing the return value to code -EINVAL
when a conversion using DAT fails with code -ENOENT, avoiding the
conflicting condition that leads to the kernel bug described above. Here,
code -EINVAL indicates that metadata corruption was detected during the
block lookup, which will be properly handled as a file system error and
converted to -EIO when passing through the nilfs2 bmap layer.
Link: https://lkml.kernel.org/r/20240313105827.5296-1-konishi.ryusuke@gmail.com
Link: https://lkml.kernel.org/r/20240313105827.5296-2-konishi.ryusuke@gmail.com
Fixes: c3a7abf06ce7 ("nilfs2: support contiguous lookup of blocks")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+cfed5b56649bddf80d6e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cfed5b56649bddf80d6e
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-03-13 19:58:26 +09:00
|
|
|
|
2009-05-25 02:47:14 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2016-05-23 16:23:39 -07:00
|
|
|
|
|
|
|
|
|
2009-05-25 02:47:14 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
nilfs2: fix failure to detect DAT corruption in btree and direct mappings
Patch series "nilfs2: fix kernel bug at submit_bh_wbc()".
This resolves a kernel BUG reported by syzbot. Since there are two
flaws involved, I've made each one a separate patch.
The first patch alone resolves the syzbot-reported bug, but I think
both fixes should be sent to stable, so I've tagged them as such.
This patch (of 2):
Syzbot has reported a kernel bug in submit_bh_wbc() when writing file data
to a nilfs2 file system whose metadata is corrupted.
There are two flaws involved in this issue.
The first flaw is that when nilfs_get_block() locates a data block using
btree or direct mapping, if the disk address translation routine
nilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata
corruption, it can be passed back to nilfs_get_block(). This causes
nilfs_get_block() to misidentify an existing block as non-existent,
causing both data block lookup and insertion to fail inconsistently.
The second flaw is that nilfs_get_block() returns a successful status in
this inconsistent state. This causes the caller __block_write_begin_int()
or others to request a read even though the buffer is not mapped,
resulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc()
failing.
This fixes the first issue by changing the return value to code -EINVAL
when a conversion using DAT fails with code -ENOENT, avoiding the
conflicting condition that leads to the kernel bug described above. Here,
code -EINVAL indicates that metadata corruption was detected during the
block lookup, which will be properly handled as a file system error and
converted to -EIO when passing through the nilfs2 bmap layer.
Link: https://lkml.kernel.org/r/20240313105827.5296-1-konishi.ryusuke@gmail.com
Link: https://lkml.kernel.org/r/20240313105827.5296-2-konishi.ryusuke@gmail.com
Fixes: c3a7abf06ce7 ("nilfs2: support contiguous lookup of blocks")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+cfed5b56649bddf80d6e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cfed5b56649bddf80d6e
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-03-13 19:58:26 +09:00
|
|
|
|
2009-05-25 02:47:14 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
nilfs2: fix failure to detect DAT corruption in btree and direct mappings
Patch series "nilfs2: fix kernel bug at submit_bh_wbc()".
This resolves a kernel BUG reported by syzbot. Since there are two
flaws involved, I've made each one a separate patch.
The first patch alone resolves the syzbot-reported bug, but I think
both fixes should be sent to stable, so I've tagged them as such.
This patch (of 2):
Syzbot has reported a kernel bug in submit_bh_wbc() when writing file data
to a nilfs2 file system whose metadata is corrupted.
There are two flaws involved in this issue.
The first flaw is that when nilfs_get_block() locates a data block using
btree or direct mapping, if the disk address translation routine
nilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata
corruption, it can be passed back to nilfs_get_block(). This causes
nilfs_get_block() to misidentify an existing block as non-existent,
causing both data block lookup and insertion to fail inconsistently.
The second flaw is that nilfs_get_block() returns a successful status in
this inconsistent state. This causes the caller __block_write_begin_int()
or others to request a read even though the buffer is not mapped,
resulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc()
failing.
This fixes the first issue by changing the return value to code -EINVAL
when a conversion using DAT fails with code -ENOENT, avoiding the
conflicting condition that leads to the kernel bug described above. Here,
code -EINVAL indicates that metadata corruption was detected during the
block lookup, which will be properly handled as a file system error and
converted to -EIO when passing through the nilfs2 bmap layer.
Link: https://lkml.kernel.org/r/20240313105827.5296-1-konishi.ryusuke@gmail.com
Link: https://lkml.kernel.org/r/20240313105827.5296-2-konishi.ryusuke@gmail.com
Fixes: c3a7abf06ce7 ("nilfs2: support contiguous lookup of blocks")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+cfed5b56649bddf80d6e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cfed5b56649bddf80d6e
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-03-13 19:58:26 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-05-25 02:47:14 +09:00
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2016-05-23 16:23:42 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
2010-07-10 22:21:54 +09:00
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
2011-03-05 00:19:32 +09:00
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
2009-05-24 03:25:44 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2011-03-05 00:19:32 +09:00
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2015-04-16 12:46:36 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-05-24 00:09:44 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:49 -07:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:49 -07:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 16:50:41 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-05-24 00:09:44 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 21:37:47 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2025-04-29 02:37:07 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 16:50:41 +09:00
|
|
|
|
|
|
|
|
|
2009-08-15 15:34:33 +09:00
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-10 16:50:41 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
2023-03-27 00:21:46 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:55 -07:00
|
|
|
|
2020-08-11 18:35:49 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:55 -07:00
|
|
|
|
|
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
2009-04-06 19:01:55 -07:00
|
|
|
|
2020-08-11 18:35:49 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:55 -07:00
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
2009-05-24 16:46:37 +09:00
|
|
|
|
2010-07-10 18:07:04 +09:00
|
|
|
|
|
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-05-25 02:47:14 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2015-04-16 12:46:36 -07:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
2015-04-16 12:46:36 -07:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-05-24 00:09:44 +09:00
|
|
|
|
2009-04-06 19:01:25 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|