kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/fs/ocfs2
History
Su Yue 94459962b8 ocfs2: check dir i_size in ocfs2_find_entry 
commit b0fce54b8c upstream.

syz reports an out of bounds read:

==================================================================
BUG: KASAN: slab-out-of-bounds in ocfs2_match fs/ocfs2/dir.c:334
[inline]
BUG: KASAN: slab-out-of-bounds in ocfs2_search_dirblock+0x283/0x6e0
fs/ocfs2/dir.c:367
Read of size 1 at addr ffff88804d8b9982 by task syz-executor.2/14802

CPU: 0 UID: 0 PID: 14802 Comm: syz-executor.2 Not tainted 6.13.0-rc4 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1
04/01/2014
Sched_ext: serialise (enabled+all), task: runnable_at=-10ms
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x229/0x350 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x164/0x530 mm/kasan/report.c:489
kasan_report+0x147/0x180 mm/kasan/report.c:602
ocfs2_match fs/ocfs2/dir.c:334 [inline]
ocfs2_search_dirblock+0x283/0x6e0 fs/ocfs2/dir.c:367
ocfs2_find_entry_id fs/ocfs2/dir.c:414 [inline]
ocfs2_find_entry+0x1143/0x2db0 fs/ocfs2/dir.c:1078
ocfs2_find_files_on_disk+0x18e/0x530 fs/ocfs2/dir.c:1981
ocfs2_lookup_ino_from_name+0xb6/0x110 fs/ocfs2/dir.c:2003
ocfs2_lookup+0x30a/0xd40 fs/ocfs2/namei.c:122
lookup_open fs/namei.c:3627 [inline]
open_last_lookups fs/namei.c:3748 [inline]
path_openat+0x145a/0x3870 fs/namei.c:3984
do_filp_open+0xe9/0x1c0 fs/namei.c:4014
do_sys_openat2+0x135/0x1d0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_openat fs/open.c:1433 [inline]
__se_sys_openat fs/open.c:1428 [inline]
__x64_sys_openat+0x15d/0x1c0 fs/open.c:1428
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f01076903ad
Code: c3 e8 a7 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89
f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f01084acfc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f01077cbf80 RCX: 00007f01076903ad
RDX: 0000000000105042 RSI: 0000000020000080 RDI: ffffffffffffff9c
RBP: 00007f01077cbf80 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000001ff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f01077cbf80 R14: 00007f010764fc90 R15: 00007f010848d000
</TASK>
==================================================================

And a general protection fault in ocfs2_prepare_dir_for_insert:

==================================================================
loop0: detected capacity change from 0 to 32768
JBD2: Ignoring recovery information on journal
ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data
mode.
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 5096 Comm: syz-executor792 Not tainted
6.11.0-rc4-syzkaller-00002-gb0da640826ba #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:ocfs2_find_dir_space_id fs/ocfs2/dir.c:3406 [inline]
RIP: 0010:ocfs2_prepare_dir_for_insert+0x3309/0x5c70 fs/ocfs2/dir.c:4280
Code: 00 00 e8 2a 25 13 fe e9 ba 06 00 00 e8 20 25 13 fe e9 4f 01 00 00
e8 16 25 13 fe 49 8d 7f 08 49 8d 5f 09 48 89 f8 48 c1 e8 03 <42> 0f b6
04 20 84 c0 0f 85 bd 23 00 00 48 89 d8 48 c1 e8 03 42 0f
RSP: 0018:ffffc9000af9f020 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000009 RCX: ffff88801e27a440
RDX: 0000000000000000 RSI: 0000000000000400 RDI: 0000000000000008
RBP: ffffc9000af9f830 R08: ffffffff8380395b R09: ffffffff838090a7
R10: 0000000000000002 R11: ffff88801e27a440 R12: dffffc0000000000
R13: ffff88803c660878 R14: f700000000000088 R15: 0000000000000000
FS:  000055555a677380(0000) GS:ffff888020800000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000560bce569178 CR3: 000000001de5a000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ocfs2_mknod+0xcaf/0x2b40 fs/ocfs2/namei.c:292
vfs_mknod+0x36d/0x3b0 fs/namei.c:4088
do_mknodat+0x3ec/0x5b0
__do_sys_mknodat fs/namei.c:4166 [inline]
__se_sys_mknodat fs/namei.c:4163 [inline]
__x64_sys_mknodat+0xa7/0xc0 fs/namei.c:4163
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2dafda3a99
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89
f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08
0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8
64 89 01 48
RSP: 002b:00007ffe336a6658 EFLAGS: 00000246 ORIG_RAX:
0000000000000103
RAX: ffffffffffffffda RBX: 0000000000000000 RCX:
00007f2dafda3a99
RDX: 00000000000021c0 RSI: 0000000020000040 RDI:
00000000ffffff9c
RBP: 00007f2dafe1b5f0 R08: 0000000000004480 R09:
000055555a6784c0
R10: 0000000000000103 R11: 0000000000000246 R12:
00007ffe336a6680
R13: 00007ffe336a68a8 R14: 431bde82d7b634db R15:
00007f2dafdec03b
</TASK>
==================================================================

The two reports are all caused invalid negative i_size of dir inode.  For
ocfs2, dir_inode can't be negative or zero.

Here add a check in which is called by ocfs2_check_dir_for_entry().  It
fixes the second report as ocfs2_check_dir_for_entry() must be called
before ocfs2_prepare_dir_for_insert().  Also set a up limit for dir with
OCFS2_INLINE_DATA_FL.  The i_size can't be great than blocksize.

Link: https://lkml.kernel.org/r/20250106140640.92260-1-glass.su@suse.com
Reported-by: Jiacheng Xu <stitch@zju.edu.cn>
Link: https://lore.kernel.org/ocfs2-devel/17a04f01.1ae74.19436d003fc.Coremail.stitch@zju.edu.cn/T/#u
Reported-by: syzbot+5a64828fcc4c2ad9b04f@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/0000000000005894f3062018caf1@google.com/T/
Signed-off-by: Su Yue <glass.su@suse.com>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-02-17 09:40:42 +01:00
..
cluster ocfs2: cluster: fix potential deadlock on &o2net_debug_lock 2023-08-18 10:18:59 -07:00
dlm ocfs2/dlm: use bitmap API instead of hand-writing it 2022-11-18 13:55:06 -08:00
dlmfs ocfs2: convert to new timestamp accessors 2024-06-27 13:49:14 +02:00
acl.c ocfs2: convert to new timestamp accessors 2024-06-27 13:49:14 +02:00
acl.h fs: port ->set_acl() to pass mnt_idmap 2023-01-19 09:24:27 +01:00
alloc.c ocfs2: convert to new timestamp accessors 2024-06-27 13:49:14 +02:00
alloc.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
aops.c ocfs2: fix uninit-value in ocfs2_get_block() 2024-10-10 11:57:51 +02:00
aops.h ocfs2: fix uninitialized value in ocfs2_file_read_iter() 2024-12-09 10:32:20 +01:00
blockcheck.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
blockcheck.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
buffer_head_io.c ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate 2024-10-10 11:57:51 +02:00
buffer_head_io.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dcache.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dcache.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dir.c ocfs2: check dir i_size in ocfs2_find_entry 2025-02-17 09:40:42 +01:00
dir.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dlmglue.c ocfs2: update seq_file index in ocfs2_dlm_seq_next 2024-12-14 19:59:57 +01:00
dlmglue.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
export.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
export.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
extent_map.c ocfs2: fix deadlock in ocfs2_get_system_file_inode 2025-01-23 17:21:18 +01:00
extent_map.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
file.c ocfs2: fix uninitialized value in ocfs2_file_read_iter() 2024-12-09 10:32:20 +01:00
file.h fs: port ->permission() to pass mnt_idmap 2023-01-19 09:24:28 +01:00
filecheck.c ocfs2: use default_groups in kobj_type 2022-01-15 16:30:24 +02:00
filecheck.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
heartbeat.c ocfs2: fix a typo in a comment 2022-07-29 18:12:36 -07:00
heartbeat.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
inode.c ocfs2: convert to new timestamp accessors 2024-06-27 13:49:14 +02:00
inode.h quota: Properly annotate i_dquot arrays with __rcu 2024-03-26 18:19:46 -04:00
ioctl.c ocfs2: reduce ioctl stack usage 2023-04-21 14:54:34 -07:00
ioctl.h fs: port ->fileattr_set() to pass mnt_idmap 2023-01-19 09:24:27 +01:00
journal.c ocfs2: fix null-ptr-deref when journal load failed. 2024-10-10 11:57:51 +02:00
journal.h ocfs2: fix DIO failure due to insufficient transaction credits 2024-07-05 09:33:54 +02:00
Kconfig fs: add CONFIG_BUFFER_HEAD 2023-08-02 09:13:09 -06:00
localalloc.c ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume" 2024-12-14 20:00:22 +01:00
localalloc.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
locks.c filelock: move file locking definitions to separate header file 2023-01-11 06:52:32 -05:00
locks.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
Makefile ocfs2: improve ocfs2 Makefile 2018-12-28 12:11:45 -08:00
mmap.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
mmap.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
move_extents.c ocfs2: convert to new timestamp accessors 2024-06-27 13:49:14 +02:00
move_extents.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
namei.c ocfs2: free inode when ocfs2_get_init_inode() fails 2024-12-14 19:59:50 +01:00
namei.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs1_fs_compat.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2.h ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger() 2024-06-27 13:49:12 +02:00
ocfs2_fs.h ocfs2: replace zero-length arrays with DECLARE_FLEX_ARRAY() helper 2022-10-03 14:21:42 -07:00
ocfs2_ioctl.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2_lockid.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2_lockingver.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2_trace.h ocfs2: fix DIO failure due to insufficient transaction credits 2024-07-05 09:33:54 +02:00
quota.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
quota_global.c ocfs2: mark dquot as inactive if failed to start trans while releasing dquot 2025-02-08 09:52:26 +01:00
quota_local.c ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv 2025-01-09 13:32:07 +01:00
refcounttree.c ocfs2: reserve space for inline xattr before attaching reflink tree 2024-10-10 11:57:51 +02:00
refcounttree.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
reservations.c ocfs2: change return type of ocfs2_resmap_init 2022-04-29 14:37:58 -07:00
reservations.h ocfs2: change return type of ocfs2_resmap_init 2022-04-29 14:37:58 -07:00
resize.c ocfs2: uncache inode which has failed entering the group 2024-11-22 15:38:33 +01:00
resize.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
slot_map.c Revert "ocfs2: mount shared volume without ha stack" 2022-07-18 15:09:15 -07:00
slot_map.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
stack_o2cb.c ocfs2: use bitmap API in fill_node_map 2022-11-18 13:55:06 -08:00
stack_user.c fs: dlm: fix F_CANCELLK to cancel pending request 2023-07-20 17:25:04 -05:00
stackglue.c ocfs2: fix memory leak in ocfs2_stack_glue_init() 2022-11-18 13:55:09 -08:00
stackglue.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
suballoc.c ocfs2: fix a deadlock when commit trans 2022-01-30 09:56:58 +02:00
suballoc.h fs/ocfs2/suballoc.h: fix spelling typo in comment 2022-10-03 14:21:42 -07:00
super.c ocfs2: fix incorrect CPU endianness conversion causing mount failure 2025-02-17 09:40:37 +01:00
super.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
symlink.c ocfs2: handle a symlink read error correctly 2025-02-17 09:40:37 +01:00
symlink.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
sysfile.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
sysfile.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
uptodate.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
uptodate.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
xattr.c ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() 2024-11-14 13:19:40 +01:00
xattr.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00