kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/fs/ocfs2
History
Andrew Kanner dd73c942ee ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() 
commit 0b63c0e01f upstream.

Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove():

[   57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12
[   57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper.  Leaking 1 clusters and removing the entry
[   57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004
[...]
[   57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0
[...]
[   57.331328] Call Trace:
[   57.331477]  <TASK>
[...]
[   57.333511]  ? do_user_addr_fault+0x3e5/0x740
[   57.333778]  ? exc_page_fault+0x70/0x170
[   57.334016]  ? asm_exc_page_fault+0x2b/0x30
[   57.334263]  ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10
[   57.334596]  ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0
[   57.334913]  ocfs2_xa_remove_entry+0x23/0xc0
[   57.335164]  ocfs2_xa_set+0x704/0xcf0
[   57.335381]  ? _raw_spin_unlock+0x1a/0x40
[   57.335620]  ? ocfs2_inode_cache_unlock+0x16/0x20
[   57.335915]  ? trace_preempt_on+0x1e/0x70
[   57.336153]  ? start_this_handle+0x16c/0x500
[   57.336410]  ? preempt_count_sub+0x50/0x80
[   57.336656]  ? _raw_read_unlock+0x20/0x40
[   57.336906]  ? start_this_handle+0x16c/0x500
[   57.337162]  ocfs2_xattr_block_set+0xa6/0x1e0
[   57.337424]  __ocfs2_xattr_set_handle+0x1fd/0x5d0
[   57.337706]  ? ocfs2_start_trans+0x13d/0x290
[   57.337971]  ocfs2_xattr_set+0xb13/0xfb0
[   57.338207]  ? dput+0x46/0x1c0
[   57.338393]  ocfs2_xattr_trusted_set+0x28/0x30
[   57.338665]  ? ocfs2_xattr_trusted_set+0x28/0x30
[   57.338948]  __vfs_removexattr+0x92/0xc0
[   57.339182]  __vfs_removexattr_locked+0xd5/0x190
[   57.339456]  ? preempt_count_sub+0x50/0x80
[   57.339705]  vfs_removexattr+0x5f/0x100
[...]

Reproducer uses faultinject facility to fail ocfs2_xa_remove() ->
ocfs2_xa_value_truncate() with -ENOMEM.

In this case the comment mentions that we can return 0 if
ocfs2_xa_cleanup_value_truncate() is going to wipe the entry
anyway. But the following 'rc' check is wrong and execution flow do
'ocfs2_xa_remove_entry(loc);' twice:
* 1st: in ocfs2_xa_cleanup_value_truncate();
* 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'.

Fix this by skipping the 2nd removal of the same entry and making
syzkaller repro happy.

Link: https://lkml.kernel.org/r/20241103193845.2940988-1-andrew.kanner@gmail.com
Fixes: 399ff3a748 ("ocfs2: Handle errors while setting external xattr values.")
Signed-off-by: Andrew Kanner <andrew.kanner@gmail.com>
Reported-by: syzbot+386ce9e60fa1b18aac5b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/671e13ab.050a0220.2b8c0f.01d0.GAE@google.com/T/
Tested-by: syzbot+386ce9e60fa1b18aac5b@syzkaller.appspotmail.com
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-11-14 13:19:40 +01:00
..
cluster ocfs2: cluster: fix potential deadlock on &o2net_debug_lock 2023-08-18 10:18:59 -07:00
dlm ocfs2/dlm: use bitmap API instead of hand-writing it 2022-11-18 13:55:06 -08:00
dlmfs ocfs2: convert to new timestamp accessors 2024-06-27 13:49:14 +02:00
acl.c ocfs2: convert to new timestamp accessors 2024-06-27 13:49:14 +02:00
acl.h fs: port ->set_acl() to pass mnt_idmap 2023-01-19 09:24:27 +01:00
alloc.c ocfs2: convert to new timestamp accessors 2024-06-27 13:49:14 +02:00
alloc.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
aops.c ocfs2: fix uninit-value in ocfs2_get_block() 2024-10-10 11:57:51 +02:00
aops.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
blockcheck.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
blockcheck.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
buffer_head_io.c ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate 2024-10-10 11:57:51 +02:00
buffer_head_io.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dcache.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dcache.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dir.c ocfs2: add bounds checking to ocfs2_check_dir_entry() 2024-07-27 11:34:08 +02:00
dir.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
dlmglue.c ocfs2: convert to new timestamp accessors 2024-06-27 13:49:14 +02:00
dlmglue.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
export.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
export.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
extent_map.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
extent_map.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
file.c ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow 2024-11-08 16:28:26 +01:00
file.h fs: port ->permission() to pass mnt_idmap 2023-01-19 09:24:28 +01:00
filecheck.c ocfs2: use default_groups in kobj_type 2022-01-15 16:30:24 +02:00
filecheck.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
heartbeat.c ocfs2: fix a typo in a comment 2022-07-29 18:12:36 -07:00
heartbeat.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
inode.c ocfs2: convert to new timestamp accessors 2024-06-27 13:49:14 +02:00
inode.h quota: Properly annotate i_dquot arrays with __rcu 2024-03-26 18:19:46 -04:00
ioctl.c ocfs2: reduce ioctl stack usage 2023-04-21 14:54:34 -07:00
ioctl.h fs: port ->fileattr_set() to pass mnt_idmap 2023-01-19 09:24:27 +01:00
journal.c ocfs2: fix null-ptr-deref when journal load failed. 2024-10-10 11:57:51 +02:00
journal.h ocfs2: fix DIO failure due to insufficient transaction credits 2024-07-05 09:33:54 +02:00
Kconfig fs: add CONFIG_BUFFER_HEAD 2023-08-02 09:13:09 -06:00
localalloc.c ocfs2: fix the la space leak when unmounting an ocfs2 volume 2024-10-10 11:57:50 +02:00
localalloc.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
locks.c filelock: move file locking definitions to separate header file 2023-01-11 06:52:32 -05:00
locks.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
Makefile ocfs2: improve ocfs2 Makefile 2018-12-28 12:11:45 -08:00
mmap.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
mmap.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
move_extents.c ocfs2: convert to new timestamp accessors 2024-06-27 13:49:14 +02:00
move_extents.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
namei.c ocfs2: update inode fsync transaction id in ocfs2_unlink and ocfs2_link 2024-06-27 13:49:14 +02:00
namei.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs1_fs_compat.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2.h ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger() 2024-06-27 13:49:12 +02:00
ocfs2_fs.h ocfs2: replace zero-length arrays with DECLARE_FLEX_ARRAY() helper 2022-10-03 14:21:42 -07:00
ocfs2_ioctl.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2_lockid.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2_lockingver.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
ocfs2_trace.h ocfs2: fix DIO failure due to insufficient transaction credits 2024-07-05 09:33:54 +02:00
quota.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
quota_global.c fs/ocfs2: Fix spelling typo in comment 2022-07-17 17:31:43 -07:00
quota_local.c ocfs2: cancel dqi_sync_work before freeing oinfo 2024-10-10 11:57:51 +02:00
refcounttree.c ocfs2: reserve space for inline xattr before attaching reflink tree 2024-10-10 11:57:51 +02:00
refcounttree.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
reservations.c ocfs2: change return type of ocfs2_resmap_init 2022-04-29 14:37:58 -07:00
reservations.h ocfs2: change return type of ocfs2_resmap_init 2022-04-29 14:37:58 -07:00
resize.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
resize.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
slot_map.c Revert "ocfs2: mount shared volume without ha stack" 2022-07-18 15:09:15 -07:00
slot_map.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
stack_o2cb.c ocfs2: use bitmap API in fill_node_map 2022-11-18 13:55:06 -08:00
stack_user.c fs: dlm: fix F_CANCELLK to cancel pending request 2023-07-20 17:25:04 -05:00
stackglue.c ocfs2: fix memory leak in ocfs2_stack_glue_init() 2022-11-18 13:55:09 -08:00
stackglue.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
suballoc.c ocfs2: fix a deadlock when commit trans 2022-01-30 09:56:58 +02:00
suballoc.h fs/ocfs2/suballoc.h: fix spelling typo in comment 2022-10-03 14:21:42 -07:00
super.c ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger() 2024-06-27 13:49:12 +02:00
super.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
symlink.c ocfs2: Convert ocfs2 to read_folio 2022-05-09 16:21:46 -04:00
symlink.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
sysfile.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
sysfile.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
uptodate.c treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
uptodate.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00
xattr.c ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() 2024-11-14 13:19:40 +01:00
xattr.h treewide: remove editor modelines and cruft 2021-05-07 00:26:34 -07:00