linux/fs/ext4
Wojciech Gładysz 3f6bbe6e07 ext4: sanity check for NULL pointer after ext4_force_shutdown
[ Upstream commit 83f4414b8f ]

Test case: 2 threads write short inline data to a file.
In ext4_page_mkwrite the resulting inline data is converted.
Handling ext4_grp_locked_error with description "block bitmap
and bg descriptor inconsistent: X vs Y free clusters" calls
ext4_force_shutdown. The conversion clears
EXT4_STATE_MAY_INLINE_DATA but fails for
ext4_destroy_inline_data_nolock and ext4_mark_iloc_dirty due
to ext4_forced_shutdown. The restoration of inline data fails
for the same reason not setting EXT4_STATE_MAY_INLINE_DATA.
Without the flag set a regular process path in ext4_da_write_end
follows trying to dereference page folio private pointer that has
not been set. The fix calls early return with -EIO error shall the
pointer to private be NULL.

Sample crash report:

Unable to handle kernel paging request at virtual address dfff800000000004
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfff800000000004] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 20274 Comm: syz-executor185 Not tainted 6.9.0-rc7-syzkaller-gfda5695d692c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __block_commit_write+0x64/0x2b0 fs/buffer.c:2167
lr : __block_commit_write+0x3c/0x2b0 fs/buffer.c:2160
sp : ffff8000a1957600
x29: ffff8000a1957610 x28: dfff800000000000 x27: ffff0000e30e34b0
x26: 0000000000000000 x25: dfff800000000000 x24: dfff800000000000
x23: fffffdffc397c9e0 x22: 0000000000000020 x21: 0000000000000020
x20: 0000000000000040 x19: fffffdffc397c9c0 x18: 1fffe000367bd196
x17: ffff80008eead000 x16: ffff80008ae89e3c x15: 00000000200000c0
x14: 1fffe0001cbe4e04 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000001 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : 0000000000000004 x7 : 0000000000000000 x6 : 0000000000000000
x5 : fffffdffc397c9c0 x4 : 0000000000000020 x3 : 0000000000000020
x2 : 0000000000000040 x1 : 0000000000000020 x0 : fffffdffc397c9c0
Call trace:
 __block_commit_write+0x64/0x2b0 fs/buffer.c:2167
 block_write_end+0xb4/0x104 fs/buffer.c:2253
 ext4_da_do_write_end fs/ext4/inode.c:2955 [inline]
 ext4_da_write_end+0x2c4/0xa40 fs/ext4/inode.c:3028
 generic_perform_write+0x394/0x588 mm/filemap.c:3985
 ext4_buffered_write_iter+0x2c0/0x4ec fs/ext4/file.c:299
 ext4_file_write_iter+0x188/0x1780
 call_write_iter include/linux/fs.h:2110 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x968/0xc3c fs/read_write.c:590
 ksys_write+0x15c/0x26c fs/read_write.c:643
 __do_sys_write fs/read_write.c:655 [inline]
 __se_sys_write fs/read_write.c:652 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:652
 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:133
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:152
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
Code: 97f85911 f94002da 91008356 d343fec8 (38796908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	97f85911 	bl	0xffffffffffe16444
   4:	f94002da 	ldr	x26, [x22]
   8:	91008356 	add	x22, x26, #0x20
   c:	d343fec8 	lsr	x8, x22, #3
* 10:	38796908 	ldrb	w8, [x8, x25] <-- trapping instruction

Reported-by: syzbot+18df508cf00a0598d9a6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=18df508cf00a0598d9a6
Link: https://lore.kernel.org/all/000000000000f19a1406109eb5c5@google.com/T/
Signed-off-by: Wojciech Gładysz <wojciech.gladysz@infogain.com>
Link: https://patch.msgid.link/20240703070112.10235-1-wojciech.gladysz@infogain.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-08-19 06:04:29 +02:00
..
.kunitconfig ext4: add .kunitconfig fragment to enable ext4-specific tests 2021-02-11 23:16:30 -05:00
acl.c ext4: convert to ctime accessor functions 2023-07-24 10:29:54 +02:00
acl.h ext4: apply umask if ACL support is disabled 2023-11-28 17:20:15 +00:00
balloc.c ext4: add correct group descriptors and reserved GDT blocks to system zone 2023-08-27 11:27:12 -04:00
bitmap.c ext4: remove useless conditional branch code 2023-04-19 23:39:08 -04:00
block_validity.c ext4: add correct group descriptors and reserved GDT blocks to system zone 2023-08-27 11:27:12 -04:00
crypto.c ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} 2023-08-05 08:17:56 -04:00
dir.c ext4: fix spelling errors in comments 2022-05-11 15:19:06 -04:00
ext4.h quota: Properly annotate i_dquot arrays with __rcu 2024-03-26 18:19:46 -04:00
ext4_extents.h ext4: fix sparse warnings 2021-08-30 23:36:50 -04:00
ext4_jbd2.c Many ext4 and jbd2 cleanups and bug fixes for v6.6-rc1. 2023-08-31 15:18:15 -07:00
ext4_jbd2.h ext4: split ext4_journal_start trace for debug 2022-12-01 10:46:54 -05:00
extents.c ext4: correct the hole length returned by ext4_map_blocks() 2024-03-01 13:34:52 +01:00
extents_status.c ext4: fix infinite loop when replaying fast_commit 2024-08-03 08:53:53 +02:00
extents_status.h ext4: make ext4_es_insert_extent() return void 2023-06-26 19:35:12 -04:00
fast_commit.c ext4: don't track ranges in fast_commit if inode has inlined data 2024-08-03 08:53:54 +02:00
fast_commit.h ext4: add missing validation of fast-commit record lengths 2022-12-08 21:49:24 -05:00
file.c ext4: fix warning in ext4_dio_write_end_io() 2023-12-20 17:01:42 +01:00
fsmap.c ext4: fix another off-by-one fsmap error on 1k block filesystems 2023-03-07 20:20:48 -05:00
fsmap.h ext4: fsmap: fix the block/inode bitmap comment 2021-06-24 09:48:29 -04:00
fsync.c ext4: drop EXT4_MF_FS_ABORTED flag 2023-07-29 18:37:53 -04:00
hash.c ext4: remove redundant checks of s_encoding 2023-08-27 11:27:13 -04:00
ialloc.c Many ext4 and jbd2 cleanups and bug fixes for v6.6-rc1. 2023-08-31 15:18:15 -07:00
indirect.c ext4: only update i_reserved_data_blocks on successful block allocation 2023-06-26 19:34:56 -04:00
inline.c ext4: fix uninitialized variable in ext4_inlinedir_to_tree 2024-08-14 13:58:46 +02:00
inode-test.c ext4: convert to ctime accessor functions 2023-07-24 10:29:54 +02:00
inode.c ext4: sanity check for NULL pointer after ext4_force_shutdown 2024-08-19 06:04:29 +02:00
ioctl.c Many ext4 and jbd2 cleanups and bug fixes for v6.6-rc1. 2023-08-31 15:18:15 -07:00
Kconfig fs: add CONFIG_BUFFER_HEAD 2023-08-02 09:13:09 -06:00
Makefile ext4: move ext4 crypto code to its own file crypto.c 2022-05-21 22:24:24 -04:00
mballoc.c ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists() 2024-06-27 13:49:10 +02:00
mballoc.h ext4: set type of ac_groups_linear_remaining to __u32 to avoid overflow 2024-06-16 13:47:44 +02:00
migrate.c ext4: avoid deadlock in fs reclaim with page writeback 2023-05-13 18:05:04 -04:00
mmp.c ext4: replace read-only check for shutdown check in mmp code 2023-07-29 18:37:53 -04:00
move_extent.c ext4: fix double-free of blocks due to wrong extents moved_len 2024-02-23 09:25:04 +01:00
namei.c ext4: make sure the first directory block is not a hole 2024-08-03 08:54:17 +02:00
orphan.c ext4: remove trailing newline from ext4_msg() message 2022-12-08 21:49:23 -05:00
page-io.c ext4: make ext4_forced_shutdown() take struct super_block 2023-07-29 18:37:24 -04:00
readpage.c ext4: Call fsverity_verify_folio() 2023-06-15 00:02:10 -04:00
resize.c ext4: fix corruption during on-line resize 2024-04-03 15:28:28 +02:00
super.c ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() 2024-06-27 13:49:03 +02:00
symlink.c fs: port ->getattr() to pass mnt_idmap 2023-01-19 09:24:25 +01:00
sysfs.c ext4: avoid ptr null pointer dereference 2024-07-18 13:21:25 +02:00
truncate.h ext4: Convert to use mapping->invalidate_lock 2021-07-13 14:29:00 +02:00
verity.c - Nick Piggin's "shoot lazy tlbs" series, to improve the peformance of 2023-04-27 19:42:02 -07:00
xattr.c ext4: do not create EA inode under buffer lock 2024-08-19 06:04:28 +02:00
xattr.h ext4: remove EA inode entry from mbcache on inode eviction 2022-08-02 23:56:25 -04:00
xattr_hurd.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr_security.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr_trusted.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr_user.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00