Tudor Ambarus 4f04351888 ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum ... When modifying the block device while it is mounted by the filesystem, syzbot reported the following: BUG: KASAN: slab-out-of-bounds in crc16+0x206/0x280 lib/crc16.c:58 Read of size 1 at addr ffff888075f5c0a8 by task syz-executor.2/15586 CPU: 1 PID: 15586 Comm: syz-executor.2 Not tainted 6.2.0-rc5-syzkaller-00205-gc96618275234 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:306 print_report+0x107/0x1f0 mm/kasan/report.c:417 kasan_report+0xcd/0x100 mm/kasan/report.c:517 crc16+0x206/0x280 lib/crc16.c:58 ext4_group_desc_csum+0x81b/0xb20 fs/ext4/super.c:3187 ext4_group_desc_csum_set+0x195/0x230 fs/ext4/super.c:3210 ext4_mb_clear_bb fs/ext4/mballoc.c:6027 [inline] ext4_free_blocks+0x191a/0x2810 fs/ext4/mballoc.c:6173 ext4_remove_blocks fs/ext4/extents.c:2527 [inline] ext4_ext_rm_leaf fs/ext4/extents.c:2710 [inline] ext4_ext_remove_space+0x24ef/0x46a0 fs/ext4/extents.c:2958 ext4_ext_truncate+0x177/0x220 fs/ext4/extents.c:4416 ext4_truncate+0xa6a/0xea0 fs/ext4/inode.c:4342 ext4_setattr+0x10c8/0x1930 fs/ext4/inode.c:5622 notify_change+0xe50/0x1100 fs/attr.c:482 do_truncate+0x200/0x2f0 fs/open.c:65 handle_truncate fs/namei.c:3216 [inline] do_open fs/namei.c:3561 [inline] path_openat+0x272b/0x2dd0 fs/namei.c:3714 do_filp_open+0x264/0x4f0 fs/namei.c:3741 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f72f8a8c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f72f97e3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 00007f72f8bac050 RCX: 00007f72f8a8c0c9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000280 RBP: 00007f72f8ae7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd165348bf R14: 00007f72f97e3300 R15: 0000000000022000 Replace le16_to_cpu(sbi->s_es->s_desc_size) with sbi->s_desc_size It reduces ext4's compiled text size, and makes the code more efficient (we remove an extra indirect reference and a potential byte swap on big endian systems), and there is no downside. It also avoids the potential KASAN / syzkaller failure, as a bonus. Reported-by: syzbot+fc51227e7100c9294894@syzkaller.appspotmail.com Reported-by: syzbot+8785e41224a3afd04321@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=70d28d11ab14bd7938f3e088365252aa923cff42 Link: https://syzkaller.appspot.com/bug?id=b85721b38583ecc6b5e72ff524c67302abbc30f3 Link: https://lore.kernel.org/all/000000000000ece18705f3b20934@google.com/ Fixes: 717d50e497 ("Ext4: Uninitialized Block Groups") Cc: stable@vger.kernel.org Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Link: https://lore.kernel.org/r/20230504121525.3275886-1-tudor.ambarus@linaro.org Signed-off-by: Theodore Ts'o <tytso@mit.edu>		2023-05-13 18:05:04 -04:00
..
9p	Including fixes from netfilter.	2023-05-05 19:12:01 -07:00
adfs	fs: port ->setattr() to pass mnt_idmap	2023-01-19 09:24:02 +01:00
affs	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
afs	Five hotfixes. Three are cc:stable, two pertain to post-6.3 merge window	2023-05-06 11:25:03 -07:00
autofs	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
befs
bfs	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
btrfs	for-6.4-tag	2023-04-26 09:13:44 -07:00
cachefiles	fs/cachefiles: simplify one-level sysctl registration for cachefiles_sysctls	2023-04-13 11:49:35 -07:00
ceph	A few filesystem improvements, with a rather nasty use-after-free fix	2023-05-04 14:48:02 -07:00
cifs	cifs: Remove unneeded semicolon	2023-05-05 04:29:58 -05:00
coda	sysctl-6.4-rc1	2023-04-27 16:52:33 -07:00
configfs	fs: consolidate duplicate dt_type helpers	2023-04-03 09:23:54 +02:00
cramfs	fs/cramfs/inode.c: initialize file_ra_state	2023-03-02 21:54:23 -08:00
crypto	fscrypt: optimize fscrypt_initialize()	2023-04-06 11:16:39 -07:00
debugfs	ARM: SoC drivers for 6.3	2023-02-27 10:04:49 -08:00
devpts	devpts: simplify two-level sysctl registration for pty_kern_table	2023-03-13 12:36:34 +01:00
dlm	Networking changes for 6.4.	2023-04-26 16:07:23 -07:00
ecryptfs	fs: drop unused posix acl handlers	2023-03-06 09:57:12 +01:00
efivarfs	A healthy mix of EFI contributions this time:	2023-02-23 14:41:48 -08:00
efs
erofs	Changes since last update:	2023-04-24 14:25:39 -07:00
exfat	Description for this pull request:	2023-03-01 08:42:27 -08:00
exportfs	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
ext2	\n	2023-04-26 09:07:46 -07:00
ext4	ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum	2023-05-13 18:05:04 -04:00
f2fs	f2fs update for 6.4-rc1	2023-04-26 09:42:10 -07:00
fat	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
freevxfs	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
fscache	fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work()	2023-01-30 12:51:54 +00:00
fuse	Driver core changes for 6.4-rc1	2023-04-27 11:53:57 -07:00
gfs2	gfs2 fixes	2023-04-26 09:28:15 -07:00
hfs	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
hfsplus	fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()	2023-04-12 11:29:32 +02:00
hostfs	um: hostfs: define our own API boundary	2023-04-20 23:04:40 +02:00
hpfs	fs: port ->rename() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
hugetlbfs	mm: move 'mmap_min_addr' logic from callers into vm_unmapped_area()	2023-04-21 14:52:05 -07:00
iomap	New code for 6.4:	2023-04-29 10:35:48 -07:00
isofs	- hfs and hfsplus kmap API modernization from Fabio Francesco	2022-10-12 11:00:22 -07:00
jbd2	jdb2: Don't refuse invalidation of already invalidated buffers	2023-04-14 19:38:50 -04:00
jffs2	fs: rename generic posix acl handlers	2023-03-06 09:57:13 +01:00
jfs	write_one_page series	2023-04-24 19:20:27 -07:00
kernfs	Driver core changes for 6.4-rc1	2023-04-27 11:53:57 -07:00
ksmbd	9 smb3 client fixes, mostly DFS or reconnect related	2023-05-07 10:46:21 -07:00
lockd	NFSD 6.4 Release Notes	2023-04-29 11:04:14 -07:00
minix	Merge branch 'work.minix' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2023-02-24 19:01:15 -08:00
netfs	- Nick Piggin's "shoot lazy tlbs" series, to improve the peformance of	2023-04-27 19:42:02 -07:00
nfs	nfs: fix mis-merged __filemap_get_folio() error check	2023-05-06 10:16:19 -07:00
nfs_common	NFSv4.2: remove MODULE_LICENSE in non-modules	2023-04-13 13:13:52 -07:00
nfsd	NFSD 6.4 Release Notes	2023-04-29 11:04:14 -07:00
nilfs2	nilfs2: do not write dirty data after degenerating to read-only	2023-05-06 10:10:07 -07:00
nls
notify	fanotify: use pidfd_prepare()	2023-04-03 11:16:57 +02:00
ntfs	ntfs: simplfy one-level sysctl registration for ntfs_sysctls	2023-04-13 11:49:35 -07:00
ntfs3	driver ntfs3 for linux 6.4	2023-04-29 10:52:37 -07:00
ocfs2	Mainly singleton patches all over the place. Series of note are:	2023-04-27 19:57:00 -07:00
omfs	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
openpromfs
orangefs	- Nick Piggin's "shoot lazy tlbs" series, to improve the peformance of	2023-04-27 19:42:02 -07:00
overlayfs	ovl: check for ->listxattr() support	2023-03-06 09:57:13 +01:00
proc	sysctl: remove register_sysctl_paths()	2023-05-02 19:24:16 -07:00
pstore	pstore update for v6.4-rc1	2023-04-27 17:03:40 -07:00
qnx4	qnx4: credit contributors in CREDITS	2023-03-14 12:56:30 -06:00
qnx6	qnx6: credit contributor and mark filesystem orphan	2023-03-14 12:56:30 -06:00
quota	quota: mark PRINT_QUOTA_WARNING as BROKEN	2023-04-14 13:06:50 +02:00
ramfs	mm, treewide: redefine MAX_ORDER sanely	2023-04-05 19:42:46 -07:00
reiserfs	\n	2023-04-26 09:07:46 -07:00
romfs	mm/nommu: factor out check for NOMMU shared mappings into is_nommu_shared_mapping()	2023-01-18 17:12:56 -08:00
smbfs_common	SMB3.1.1: correct definition for app_instance_id create contexts	2023-05-02 09:23:23 -05:00
squashfs	revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"	2023-02-03 17:52:25 -08:00
sysfs
sysv	sysv: switch to put_and_unmap_page()	2023-03-12 20:03:41 -04:00
tracefs	fs: port ->mkdir() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
ubifs	ubifs: Fix memleak when insert_old_idx() failed	2023-04-23 23:36:38 +02:00
udf	udf: use wrapper i_blocksize() in udf_discard_prealloc()	2023-03-13 11:16:16 +01:00
ufs	ufs: don't flush page immediately for DIRSYNC directories	2023-03-28 16:20:14 -07:00
unicode	unicode: remove MODULE_LICENSE in non-modules	2023-04-13 13:13:54 -07:00
vboxsf	fs: port ->rename() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
verity	fsverity: reject FS_IOC_ENABLE_VERITY on mode 3 fds	2023-04-11 19:23:23 -07:00
xfs	xfs: New code for 6.4	2023-04-29 10:44:27 -07:00
zonefs	zonefs: Do not propagate iomap_dio_rw() ENOTBLK error to user space	2023-03-30 20:56:02 +09:00
aio.c	Merge branch 'mm-hotfixes-stable' into mm-stable	2023-02-10 15:34:48 -08:00
anon_inodes.c
attr.c	nfs: use vfs setgid helper	2023-03-30 08:51:48 +02:00
bad_inode.c	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
binfmt_elf_fdpic.c	ELF: fix all "Elf" typos	2023-04-08 13:45:37 -07:00
binfmt_elf_test.c
binfmt_elf.c	Mainly singleton patches all over the place. Series of note are:	2023-04-27 19:57:00 -07:00
binfmt_flat.c
binfmt_misc.c	binfmt_misc: fix shift-out-of-bounds in check_special_flags	2022-12-02 13:57:04 -08:00
binfmt_script.c
buffer.c	- Nick Piggin's "shoot lazy tlbs" series, to improve the peformance of	2023-04-27 19:42:02 -07:00
char_dev.c	chardev: fix error handling in cdev_device_add()	2022-12-02 17:48:59 +01:00
compat_binfmt_elf.c
coredump.c	mm: hwpoison: coredump: support recovery from dump_user_range()	2023-05-02 17:21:50 -07:00
d_path.c
dax.c	fsdax: force clear dirty mark if CoW	2023-04-05 18:06:23 -07:00
dcache.c	tmpfile API change	2022-10-10 19:45:17 -07:00
direct-io.c	__blockdev_direct_IO(): get rid of submit_io callback	2023-03-05 20:27:41 -05:00
drop_caches.c
eventfd.c	eventfd: use wait_event_interruptible_locked_irq() helper	2023-04-06 10:01:50 +02:00
eventpoll.c	Mainly singleton patches all over the place. Series of note are:	2023-04-27 19:57:00 -07:00
exec.c	tracing updates for 6.4:	2023-04-28 15:57:53 -07:00
fcntl.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
fhandle.c	do_sys_name_to_handle(): constify path	2022-09-01 17:36:39 -04:00
file_table.c	filelock: move file locking definitions to separate header file	2023-01-11 06:52:32 -05:00
file.c	fs: prevent out-of-bounds array speculation when closing a file descriptor	2023-03-09 22:46:21 -05:00
filesystems.c
fs_context.c
fs_parser.c	ext4: journal_path mount options should follow links	2022-12-01 10:46:54 -05:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	for-6.4/block-2023-05-06	2023-05-06 08:28:58 -07:00
fsopen.c
init.c	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
inode.c	- Nick Piggin's "shoot lazy tlbs" series, to improve the peformance of	2023-04-27 19:42:02 -07:00
internal.h	five ksmbd server fixes, and new lock_rename_child VFS helper routine	2023-04-29 11:10:39 -07:00
ioctl.c	fs: port inode_owner_or_capable() to mnt_idmap	2023-01-19 09:24:29 +01:00
Kconfig	mm/hugetlb_vmemmap: rename ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP	2023-04-18 16:30:09 -07:00
Kconfig.binfmt	Xtensa updates for v6.1	2022-10-10 14:21:11 -07:00
kernel_read_file.c
libfs.c	fs: consolidate duplicate dt_type helpers	2023-04-03 09:23:54 +02:00
locks.c	filelocks: use mount idmapping for setlease permission check	2023-03-09 22:36:12 +01:00
Makefile	This pull request contains the following changes for UML:	2023-05-03 19:02:03 -07:00
mbcache.c	ext4: fix deadlock due to mbcache entry corruption	2022-12-08 21:49:25 -05:00
mnt_idmapping.c	fs: move mnt_idmap	2023-01-19 09:24:30 +01:00
mount.h
mpage.c	mpage: use folios in bio end_io handler	2023-04-18 16:30:02 -07:00
namei.c	five ksmbd server fixes, and new lock_rename_child VFS helper routine	2023-04-29 11:10:39 -07:00
namespace.c	fget() to fdget() conversions	2023-04-24 19:14:20 -07:00
no-block.c
nsfs.c	kill the last remaining user of proc_ns_fget()	2023-04-20 22:55:35 -04:00
open.c	open: return EINVAL for O_DIRECTORY | O_CREAT	2023-03-22 11:06:55 +01:00
pipe.c	pipe: set FMODE_NOWAIT on pipes	2023-04-25 14:08:59 -06:00
pnode.c	pnode: pass mountpoint directly	2023-04-06 14:53:38 +02:00
pnode.h
posix_acl.c	acl: don't depend on IOP_XATTR	2023-03-06 09:59:20 +01:00
proc_namespace.c
read_write.c	iov_iter: add iter_iov_addr() and iter_iov_len() helpers	2023-03-30 08:12:29 -06:00
readdir.c
remap_range.c	fs: port i_{g,u}id_into_vfs{g,u}id() to mnt_idmap	2023-01-19 09:24:29 +01:00
select.c
seq_file.c	use less confusing names for iov_iter direction initializers	2022-11-25 13:01:55 -05:00
signalfd.c
splice.c	pipe-nonblock-2023-05-06	2023-05-06 08:15:20 -07:00
stack.c
stat.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
statfs.c
super.c	mm: shrinkers: convert shrinker_rwsem to mutex	2023-03-28 16:20:17 -07:00
sync.c
sysctls.c
timerfd.c
userfaultfd.c	- Nick Piggin's "shoot lazy tlbs" series, to improve the peformance of	2023-04-27 19:42:02 -07:00
utimes.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
xattr.c	acl: don't depend on IOP_XATTR	2023-03-06 09:59:20 +01:00