kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/fs/ocfs2
History
Prithvi Tambewagh 7acc0390e0 ocfs2: fix kernel BUG in ocfs2_find_victim_chain 
commit 039bef30e3 upstream.

syzbot reported a kernel BUG in ocfs2_find_victim_chain() because the
`cl_next_free_rec` field of the allocation chain list (next free slot in
the chain list) is 0, triggring the BUG_ON(!cl->cl_next_free_rec)
condition in ocfs2_find_victim_chain() and panicking the kernel.

To fix this, an if condition is introduced in ocfs2_claim_suballoc_bits(),
just before calling ocfs2_find_victim_chain(), the code block in it being
executed when either of the following conditions is true:

1. `cl_next_free_rec` is equal to 0, indicating that there are no free
chains in the allocation chain list
2. `cl_next_free_rec` is greater than `cl_count` (the total number of
chains in the allocation chain list)

Either of them being true is indicative of the fact that there are no
chains left for usage.

This is addressed using ocfs2_error(), which prints
the error log for debugging purposes, rather than panicking the kernel.

Link: https://lkml.kernel.org/r/20251201130711.143900-1-activprithvi@gmail.com
Signed-off-by: Prithvi Tambewagh <activprithvi@gmail.com>
Reported-by: syzbot+96d38c6e1655c1420a72@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=96d38c6e1655c1420a72
Tested-by: syzbot+96d38c6e1655c1420a72@syzkaller.appspotmail.com
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-01-02 12:57:19 +01:00
..
cluster treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
dlm Patch series in this pull request: 2025-10-02 18:44:54 -07:00
dlmfs vfs-6.18-rc1.workqueue 2025-09-29 10:27:17 -07:00
acl.c ocfs2: convert to new timestamp accessors 2023-10-18 14:08:24 +02:00
acl.h fs: port ->set_acl() to pass mnt_idmap 2023-01-19 09:24:27 +01:00
alloc.c ocfs2: fix memory leak in ocfs2_merge_rec_left() 2025-12-18 14:03:41 +01:00
alloc.h ocfs2: convert ocfs2_map_and_dirty_page() to ocfs2_map_and_dirty_folio() 2025-01-12 20:21:13 -08:00
aops.c Significant patch series in this pull request: 2025-08-03 16:23:09 -07:00
aops.h ocfs2: remove ocfs2_start_walk_page_trans() prototype 2025-01-12 20:21:13 -08:00
blockcheck.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
blockcheck.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
buffer_head_io.c ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate 2024-09-09 15:15:54 -07:00
buffer_head_io.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dcache.c ocfs2_dentry_revalidate(): use stable parent inode and name passed by caller 2025-01-27 19:25:24 -05:00
dcache.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dir.c ocfs2: avoid NULL pointer dereference in dx_dir_lookup_rec() 2025-07-19 19:08:27 -07:00
dir.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dlmglue.c ocfs2: use str_yes_no() and str_no_yes() helper functions 2025-01-24 22:47:28 -08:00
dlmglue.h ocfs2: convert ocfs2_inode_lock_with_page() to ocfs2_inode_lock_with_folio() 2025-01-12 20:21:10 -08:00
export.c exportfs: Remove EXPORT_OP_ASYNC_LOCK 2024-10-01 17:01:08 +02:00
export.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
extent_map.c ocfs2: fix recursive semaphore deadlock in fiemap call 2025-09-08 23:45:11 -07:00
extent_map.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
file.c fs: replace mmap hook with .mmap_prepare for simple mappings 2025-06-19 13:56:59 +02:00
file.h ocfs2: store cookie in private data 2024-09-12 11:58:44 +02:00
filecheck.c ocfs2: simplify return statement in ocfs2_filecheck_attr_store() 2025-05-11 17:54:08 -07:00
filecheck.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
heartbeat.c ocfs2: fix a typo in a comment 2022-07-29 18:12:36 -07:00
heartbeat.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
inode.c ocfs2: use correct endian in ocfs2_dinode_has_extents 2025-12-18 14:02:58 +01:00
inode.h quota: Properly annotate i_dquot arrays with __rcu 2024-02-08 12:04:59 +01:00
ioctl.c ocfs2: avoid extra calls to strlen() after ocfs2_sprintf_system_inode_name() 2025-09-22 20:11:00 -07:00
ioctl.h tree-wide: s/struct fileattr/struct file_kattr/g 2025-07-04 16:14:39 +02:00
journal.c ocfs2: stop quota recovery before disabling quotas 2025-05-07 23:39:40 -07:00
journal.h ocfs2: stop quota recovery before disabling quotas 2025-05-07 23:39:40 -07:00
Kconfig fs: add CONFIG_BUFFER_HEAD 2023-08-02 09:13:09 -06:00
localalloc.c ocfs2: fix the space leak in LA when releasing LA 2024-12-18 19:04:41 -08:00
localalloc.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
locks.c ocfs2: adapt to breakup of struct file_lock 2024-02-05 13:11:43 +01:00
locks.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
Makefile ocfs2: improve ocfs2 Makefile 2018-12-28 12:11:45 -08:00
mmap.c fs: replace mmap hook with .mmap_prepare for simple mappings 2025-06-19 13:56:59 +02:00
mmap.h fs: replace mmap hook with .mmap_prepare for simple mappings 2025-06-19 13:56:59 +02:00
move_extents.c ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() 2025-12-18 14:02:58 +01:00
move_extents.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
namei.c ocfs2: update d_splice_alias() return code checking 2025-07-09 22:57:57 -07:00
namei.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs1_fs_compat.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2.h ocfs2: stop quota recovery before disabling quotas 2025-05-07 23:39:40 -07:00
ocfs2_fs.h ocfs2: fix super block reserved field offset comment 2025-09-13 17:32:49 -07:00
ocfs2_ioctl.h ocfs2: miscellaneous spelling fixes 2025-01-12 20:21:07 -08:00
ocfs2_lockid.h ocfs2: miscellaneous spelling fixes 2025-01-12 20:21:07 -08:00
ocfs2_lockingver.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2_trace.h ocfs2: convert to the new mount API 2025-01-12 20:21:06 -08:00
quota.h ocfs2: remove unused declaration in header file 2024-11-05 17:12:26 -08:00
quota_global.c ocfs2: remove reference to bh->b_page 2025-03-16 23:24:13 -07:00
quota_local.c ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery 2025-05-11 17:54:11 -07:00
refcounttree.c VFS: rename kern_path_locked() and related functions. 2025-09-23 12:37:36 +02:00
refcounttree.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
reservations.c ocfs2: correctly use ocfs2_find_next_zero_bit() 2024-04-25 21:07:01 -07:00
reservations.h ocfs2: miscellaneous spelling fixes 2025-01-12 20:21:07 -08:00
resize.c ocfs2: uncache inode which has failed entering the group 2024-11-14 22:43:48 -08:00
resize.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
slot_map.c ocfs2: Annotate struct ocfs2_slot_info with __counted_by 2023-10-02 09:48:52 -07:00
slot_map.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
stack_o2cb.c ocfs2: miscellaneous spelling fixes 2025-01-12 20:21:07 -08:00
stack_user.c Patch series in this pull request: 2025-10-02 18:44:54 -07:00
stackglue.c ocfs2: remove unnecessary NULL check before unregister_sysctl_table() 2025-05-11 17:54:11 -07:00
stackglue.h ocfs2: miscellaneous spelling fixes 2025-01-12 20:21:07 -08:00
suballoc.c ocfs2: fix kernel BUG in ocfs2_find_victim_chain 2026-01-02 12:57:19 +01:00
suballoc.h ocfs2: fix the issue with discontiguous allocation in the global_bitmap 2025-05-07 23:39:37 -07:00
super.c new helper: set_default_d_op() 2025-06-10 22:21:16 -04:00
super.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
symlink.c ocfs2: use a folio in ocfs2_fast_symlink_read_folio() 2025-01-12 20:21:13 -08:00
symlink.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
sysfile.c ocfs2: avoid extra calls to strlen() after ocfs2_sprintf_system_inode_name() 2025-09-22 20:11:00 -07:00
sysfile.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
uptodate.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
uptodate.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
xattr.c ocfs2: miscellaneous spelling fixes 2025-01-12 20:21:07 -08:00
xattr.h ocfs2: move ocfs2_xattr_handlers and ocfs2_xattr_handler_map to .rodata 2023-10-09 16:24:20 +02:00