linux

mirror of https://github.com/torvalds/linux.git synced 2026-06-06 05:27:07 +02:00

Linux kernel source tree

Go to file

Chao Yu 498b7088db f2fs: fix to do sanity check on curseg->alloc_type [ Upstream commit `f41ee8b91c` ] As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215657 - Overview UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image - Reproduce tested on kernel 5.17-rc4, 5.17-rc6 1. mkdir test_crash 2. cd test_crash 3. unzip tmp2.zip 4. mkdir mnt 5. ./single_test.sh f2fs 2 - Kernel dump [ 46.434454] loop0: detected capacity change from 0 to 131072 [ 46.529839] F2FS-fs (loop0): Mounted with checkpoint version = 7548c2d9 [ 46.738319] ================================================================================ [ 46.738412] UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 [ 46.738475] index 231 is out of range for type 'unsigned int [2]' [ 46.738539] CPU: 2 PID: 939 Comm: umount Not tainted 5.17.0-rc6 #1 [ 46.738547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 46.738551] Call Trace: [ 46.738556] <TASK> [ 46.738563] dump_stack_lvl+0x47/0x5c [ 46.738581] ubsan_epilogue+0x5/0x50 [ 46.738592] __ubsan_handle_out_of_bounds+0x68/0x80 [ 46.738604] f2fs_allocate_data_block+0xdff/0xe60 [f2fs] [ 46.738819] do_write_page+0xef/0x210 [f2fs] [ 46.738934] f2fs_do_write_node_page+0x3f/0x80 [f2fs] [ 46.739038] __write_node_page+0x2b7/0x920 [f2fs] [ 46.739162] f2fs_sync_node_pages+0x943/0xb00 [f2fs] [ 46.739293] f2fs_write_checkpoint+0x7bb/0x1030 [f2fs] [ 46.739405] kill_f2fs_super+0x125/0x150 [f2fs] [ 46.739507] deactivate_locked_super+0x60/0xc0 [ 46.739517] deactivate_super+0x70/0xb0 [ 46.739524] cleanup_mnt+0x11a/0x200 [ 46.739532] __cleanup_mnt+0x16/0x20 [ 46.739538] task_work_run+0x67/0xa0 [ 46.739547] exit_to_user_mode_prepare+0x18c/0x1a0 [ 46.739559] syscall_exit_to_user_mode+0x26/0x40 [ 46.739568] do_syscall_64+0x46/0xb0 [ 46.739584] entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is we missed to do sanity check on curseg->alloc_type, result in out-of-bound accessing on sbi->block_count[] array, fix it. Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-04-08 14:40:33 +02:00
arch	parisc: Fix handling off probe non-access faults	2022-04-08 14:40:32 +02:00
block	Revert "Revert "block, bfq: honor already-setup queue merges""	2022-04-08 14:40:32 +02:00
certs	certs: Trigger creation of RSA module signing key if it's not an RSA key	2021-09-15 09:50:29 +02:00
crypto	crypto: authenc - Fix sleep in atomic context in decrypt_tail	2022-04-08 14:39:59 +02:00
Documentation	Documentation: update stable tree link	2022-04-08 14:39:50 +02:00
drivers	spi: tegra20: Use of_device_get_match_data()	2022-04-08 14:40:32 +02:00
fs	f2fs: fix to do sanity check on curseg->alloc_type	2022-04-08 14:40:33 +02:00
include	serial: 8250: fix XOFF/XON sending when DMA is used	2022-04-08 14:40:28 +02:00
init	bpf: Add kconfig knob for disabling unpriv bpf by default	2022-01-05 12:40:34 +01:00
ipc	shm: extend forced shm destroy to support objects from several IPC nses	2021-12-01 09:19:10 +01:00
kernel	locking/lockdep: Iterate lock_classes directly when reading lockdep files	2022-04-08 14:40:32 +02:00
lib	lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3	2022-04-08 14:40:31 +02:00
LICENSES	LICENSES/deprecated: add Zlib license text	2020-09-16 14:33:49 +02:00
mm	mm/kmemleak: reset tag when compare object pointer	2022-04-08 14:39:54 +02:00
net	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-04-08 14:40:30 +02:00
samples	samples/bpf, xdpsock: Fix race when running for fix duration of time	2022-04-08 14:40:21 +02:00
scripts	gcc-plugins/stackleak: Exactly match strings instead of prefixes	2022-04-08 14:40:30 +02:00
security	Fix incorrect type in assignment of ipv6 port for audit	2022-04-08 14:40:31 +02:00
sound	ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data	2022-04-08 14:40:11 +02:00
tools	selftests: test_vxlan_under_vrf: Fix broken test case	2022-04-08 14:40:29 +02:00
usr	usr/include/Makefile: add linux/nfc.h to the compile-test coverage	2022-02-01 17:25:48 +01:00
virt	KVM: eventfd: Fix false positive RCU usage warning	2022-02-16 12:54:20 +01:00
.clang-format	RDMA 5.10 pull request	2020-10-17 11:18:18 -07:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore	kbuild: generate Module.symvers only when vmlinux exists	2021-05-19 10:12:59 +02:00
.mailmap	mailmap: add two more addresses of Uwe Kleine-König	2020-12-06 10:19:07 -08:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Move Jason Cooper to CREDITS	2020-11-30 10:20:34 +01:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal	2021-12-14 11:32:46 +01:00
Makefile	Linux 5.10.109	2022-03-28 09:57:11 +02:00
README

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.