kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/fs/ext4
History
Zhang Yi e1f8a51a86 ext4: fix hole length calculation overflow in non-extent inodes 
commit 02c7f7219a upstream.

In a filesystem with a block size larger than 4KB, the hole length
calculation for a non-extent inode in ext4_ind_map_blocks() can easily
exceed INT_MAX. Then it could return a zero length hole and trigger the
following waring and infinite in the iomap infrastructure.

  ------------[ cut here ]------------
  WARNING: CPU: 3 PID: 434101 at fs/iomap/iter.c:34 iomap_iter_done+0x148/0x190
  CPU: 3 UID: 0 PID: 434101 Comm: fsstress Not tainted 6.16.0-rc7+ #128 PREEMPT(voluntary)
  Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022
  pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
  pc : iomap_iter_done+0x148/0x190
  lr : iomap_iter+0x174/0x230
  sp : ffff8000880af740
  x29: ffff8000880af740 x28: ffff0000db8e6840 x27: 0000000000000000
  x26: 0000000000000000 x25: ffff8000880af830 x24: 0000004000000000
  x23: 0000000000000002 x22: 000001bfdbfa8000 x21: ffffa6a41c002e48
  x20: 0000000000000001 x19: ffff8000880af808 x18: 0000000000000000
  x17: 0000000000000000 x16: ffffa6a495ee6cd0 x15: 0000000000000000
  x14: 00000000000003d4 x13: 00000000fa83b2da x12: 0000b236fc95f18c
  x11: ffffa6a4978b9c08 x10: 0000000000001da0 x9 : ffffa6a41c1a2a44
  x8 : ffff8000880af5c8 x7 : 0000000001000000 x6 : 0000000000000000
  x5 : 0000000000000004 x4 : 000001bfdbfa8000 x3 : 0000000000000000
  x2 : 0000000000000000 x1 : 0000004004030000 x0 : 0000000000000000
  Call trace:
   iomap_iter_done+0x148/0x190 (P)
   iomap_iter+0x174/0x230
   iomap_fiemap+0x154/0x1d8
   ext4_fiemap+0x110/0x140 [ext4]
   do_vfs_ioctl+0x4b8/0xbc0
   __arm64_sys_ioctl+0x8c/0x120
   invoke_syscall+0x6c/0x100
   el0_svc_common.constprop.0+0x48/0xf0
   do_el0_svc+0x24/0x38
   el0_svc+0x38/0x120
   el0t_64_sync_handler+0x10c/0x138
   el0t_64_sync+0x198/0x1a0
  ---[ end trace 0000000000000000 ]---

Cc: stable@kernel.org
Fixes: facab4d971 ("ext4: return hole from ext4_map_blocks()")
Reported-by: Qu Wenruo <wqu@suse.com>
Closes: https://lore.kernel.org/linux-ext4/9b650a52-9672-4604-a765-bb6be55d1e4a@gmx.com/
Tested-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Link: https://patch.msgid.link/20250811064532.1788289-1-yi.zhang@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-08-28 16:24:28 +02:00
..
.kunitconfig ext4: add .kunitconfig fragment to enable ext4-specific tests 2021-02-11 23:16:30 -05:00
acl.c ext4: use ext4_journal_start/stop for fast commit transactions 2023-05-11 23:00:16 +09:00
acl.h ext4: apply umask if ACL support is disabled 2023-11-28 16:56:35 +00:00
balloc.c ext4: reorder capability check last 2025-06-04 14:37:56 +02:00
bitmap.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
block_validity.c ext4: make block validity check resistent to sb bh corruption 2025-05-02 07:44:38 +02:00
dir.c ext4: fix OOB read when checking dotdot dir 2025-04-10 14:32:06 +02:00
ext4.h ext4: make 'abort' mount option handling standard 2025-06-27 11:05:37 +01:00
ext4_extents.h ext4: fix sparse warnings 2021-08-30 23:36:50 -04:00
ext4_jbd2.c ext4: use ext4_debug() instead of jbd_debug() 2023-01-12 11:59:04 +01:00
ext4_jbd2.h ext4: Support for checksumming from journal triggers 2021-08-30 23:36:50 -04:00
extents.c ext4: prevent stale extent cache entries caused by concurrent get es_cache 2025-06-27 11:05:30 +01:00
extents_status.c ext4: make ext4_es_insert_extent() return void 2024-08-19 05:45:28 +02:00
extents_status.h ext4: make ext4_es_insert_extent() return void 2024-08-19 05:45:28 +02:00
fast_commit.c ext4: use handle to mark fc as ineligible in __track_dentry_update() 2024-10-17 15:11:38 +02:00
fast_commit.h ext4: add missing validation of fast-commit record lengths 2023-01-12 11:59:05 +01:00
file.c ext4: factor out ext4_get_maxbytes() 2025-06-27 11:05:25 +01:00
fsmap.c ext4: fix reserved gdt blocks handling in fsmap 2025-08-28 16:24:28 +02:00
fsmap.h ext4: fsmap: fix the block/inode bitmap comment 2021-06-24 09:48:29 -04:00
fsync.c block: use an on-stack bio in blkdev_issue_flush 2021-01-27 09:51:48 -07:00
hash.c ext4: improve error handling from ext4_dirhash() 2023-05-17 11:50:30 +02:00
ialloc.c ext4: avoid negative min_clusters in find_group_orlov() 2024-10-17 15:10:57 +02:00
indirect.c ext4: fix hole length calculation overflow in non-extent inodes 2025-08-28 16:24:28 +02:00
inline.c ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr 2025-08-28 16:24:23 +02:00
inode-test.c fs: ext4: Modify inode-test.c to use KUnit parameterized testing feature 2020-12-02 16:07:25 -07:00
inode.c ext4: check fast symlink for ea_inode correctly 2025-08-28 16:24:28 +02:00
ioctl.c ext4: prevent stale extent cache entries caused by concurrent get es_cache 2025-06-27 11:05:30 +01:00
Kconfig ext: EXT4_KUNIT_TESTS should depend on EXT4_FS instead of selecting it 2021-02-11 23:12:59 -05:00
Makefile ext4: Move orphan inode handling into a separate file 2021-08-30 23:36:51 -04:00
mballoc.c ext4: fix largest free orders lists corruption on mb_optimize_scan switch 2025-08-28 16:24:26 +02:00
mballoc.h ext4: fix FS_IOC_GETFSMAP handling 2024-12-14 19:51:12 +01:00
migrate.c ext4: fix i_data_sem unlock order in ext4_ind_migrate() 2024-10-17 15:11:33 +02:00
mmp.c ext4: fix lockdep warning when enabling MMP 2023-05-24 17:36:43 +01:00
move_extent.c ext4: update orig_path in ext4_find_extent() 2024-10-17 15:11:38 +02:00
namei.c ext4: fix off-by-one error in do_split 2025-05-02 07:44:02 +02:00
orphan.c ext4: use kmalloc_array() for array space allocation 2025-08-28 16:24:28 +02:00
page-io.c ext4: handle redirtying in ext4_bio_write_page() 2024-09-12 11:07:42 +02:00
readpage.c block: Add bio_max_segs 2021-02-26 15:49:51 -07:00
resize.c ext4: fix corruption during on-line resize 2024-04-10 16:18:40 +02:00
super.c ext4: don't try to clear the orphan_present feature block device is r/o 2025-08-28 16:24:28 +02:00
symlink.c ext4: report correct st_size for encrypted symlinks 2021-07-25 20:01:06 -07:00
sysfs.c ext4: Fix function prototype mismatch for ext4_feat_ktype 2023-02-25 12:06:45 +01:00
truncate.h ext4: Convert to use mapping->invalidate_lock 2021-07-13 14:29:00 +02:00
verity.c fs: ext4: initialize fsdata in pagecache_write() 2023-01-12 11:59:00 +01:00
xattr.c ext4: ignore xattrs past end 2025-05-02 07:43:55 +02:00
xattr.h ext4: remove EA inode entry from mbcache on inode eviction 2022-08-17 14:24:27 +02:00
xattr_hurd.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_security.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_trusted.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_user.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00