Chen Zhongjin e7f21d10e9 nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty ... commit 512c5ca01a upstream. When extending segments, nilfs_sufile_alloc() is called to get an unassigned segment, then mark it as dirty to avoid accidentally allocating the same segment in the future. But for some special cases such as a corrupted image it can be unreliable. If such corruption of the dirty state of the segment occurs, nilfs2 may reallocate a segment that is in use and pick the same segment for writing twice at the same time. This will cause the problem reported by syzkaller: https://syzkaller.appspot.com/bug?id=c7c4748e11ffcc367cef04f76e02e931833cbd24 This case started with segbuf1.segnum = 3, nextnum = 4 when constructed. It supposed segment 4 has already been allocated and marked as dirty. However the dirty state was corrupted and segment 4 usage was not dirty. For the first time nilfs_segctor_extend_segments() segment 4 was allocated again, which made segbuf2 and next segbuf3 had same segment 4. sb_getblk() will get same bh for segbuf2 and segbuf3, and this bh is added to both buffer lists of two segbuf. It makes the lists broken which causes NULL pointer dereference. Fix the problem by setting usage as dirty every time in nilfs_sufile_mark_dirty(), which is called during constructing current segment to be written out and before allocating next segment. [chenzhongjin@huawei.com: add lock protection per Ryusuke] Link: https://lkml.kernel.org/r/20221121091141.214703-1-chenzhongjin@huawei.com Link: https://lkml.kernel.org/r/20221118063304.140187-1-chenzhongjin@huawei.com Fixes: 9ff05123e3 ("nilfs2: segment constructor") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> Reported-by: <syzbot+77e4f0...@syzkaller.appspotmail.com> Reported-by: Liu Shixin <liushixin2@huawei.com> Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-12-02 17:40:04 +01:00
..
9p	9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"	2022-06-22 14:13:12 +02:00
adfs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
affs	fs/affs: release old buffer head on error path	2021-03-04 11:38:37 +01:00
afs	afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked	2022-09-23 14:17:00 +02:00
autofs	autofs: harden ioctl table	2020-10-16 11:11:22 -07:00
befs	[PATCH] reduce boilerplate in fsid handling	2020-09-18 16:45:50 -04:00
bfs	bfs: don't use WARNING: string when it's just info.	2021-01-06 14:56:52 +01:00
btrfs	btrfs: remove pointless and double ulist frees in error paths of qgroup tests	2022-11-25 17:45:40 +01:00
cachefiles	fs/cachefiles: Remove wait_bit_key layout dependency	2021-03-30 14:32:07 +02:00
ceph	ceph: fix NULL pointer dereference for req->r_session	2022-12-02 17:40:03 +01:00
cifs	cifs: add check for returning value of SMB2_set_info_init	2022-11-25 17:45:48 +01:00
coda
configfs	configfs: fix a race in configfs_{,un}register_subsystem()	2022-03-02 11:42:52 +01:00
cramfs	[PATCH] reduce boilerplate in fsid handling	2020-09-18 16:45:50 -04:00
crypto	fscrypt: fix keyring memory leak on mount failure	2022-11-10 18:14:25 +01:00
debugfs	debugfs: add debugfs_lookup_and_remove()	2022-09-15 11:32:03 +02:00
devpts	fsnotify: fix fsnotify hooks in pseudo filesystems	2022-02-01 17:25:39 +01:00
dlm	fs: dlm: handle -EBUSY first in lock arg validation	2022-10-26 13:25:08 +02:00
ecryptfs	Revert "ecryptfs: replace BUG_ON with error handling code"	2021-05-26 12:06:55 +02:00
efivarfs	efivarfs: revert "fix memory leak in efivarfs_create()"	2020-11-25 16:55:02 +01:00
efs	[PATCH] reduce boilerplate in fsid handling	2020-09-18 16:45:50 -04:00
erofs	erofs: avoid consecutive detection for Highmem memory	2022-08-21 15:15:35 +02:00
exfat	exfat: check if cluster num is valid	2022-06-06 08:42:42 +02:00
exportfs
ext2	ext2: Add more validity checks for inode counts	2022-08-21 15:15:28 +02:00
ext4	ext4: fix use-after-free in ext4_ext_shift_extents	2022-12-02 17:40:02 +01:00
f2fs	ext4,f2fs: fix readahead of verity data	2022-11-10 18:14:29 +01:00
fat	fat: add ratelimit to fat*_ent_bread()	2022-06-09 10:20:58 +02:00
freevxfs
fscache	fscache: Fix cookie key hashing	2021-09-18 13:40:15 +02:00
fuse	fuse: fix readdir cache race	2022-11-16 09:57:07 +01:00
gfs2	gfs2: Switch from strlcpy to strscpy	2022-11-25 17:45:56 +01:00
hfs	hfs: add lock nesting notation to hfs_find_init	2021-07-31 08:16:12 +02:00
hfsplus	hfsplus: prevent corruption in shrinking truncate	2021-05-19 10:13:10 +02:00
hostfs	hostfs: fix memory handling in follow_link()	2021-04-14 08:42:06 +02:00
hpfs	[PATCH] reduce boilerplate in fsid handling	2020-09-18 16:45:50 -04:00
hugetlbfs	mm, hugetlb: allow for "high" userspace addresses	2022-04-27 13:53:54 +02:00
iomap	xfs: use current->journal_info for detecting transaction recursion	2022-07-07 17:52:19 +02:00
isofs	isofs: Fix out of bound access for corrupted isofs image	2021-11-12 14:58:33 +01:00
jbd2	jbd2: add miss release buffer head in fc_do_one_pass()	2022-10-26 13:25:13 +02:00
jffs2	jffs2: fix memory leak in jffs2_do_fill_super	2022-06-14 18:32:35 +02:00
jfs	fs: jfs: fix possible NULL pointer dereference in dbFree()	2022-06-09 10:20:57 +02:00
kernfs	kernfs: fix use-after-free in __kernfs_remove	2022-11-03 23:57:50 +09:00
lockd	lockd: lockd server-side shouldn't set fl_ops	2021-09-18 13:40:30 +02:00
minix	minix: fix bug when opening a file with O_DIRECT	2022-04-13 21:01:01 +02:00
nfs	NFSv4: Retry LOCK on OLD_STATEID during delegation return	2022-11-25 17:45:40 +01:00
nfs_common	nfs_common: need lock during iterate through the list	2020-12-30 11:53:45 +01:00
nfsd	NFSD: fix use-after-free on source server when doing inter-server copy	2022-10-26 13:25:45 +02:00
nilfs2	nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty	2022-12-02 17:40:04 +01:00
nls
notify	fsnotify: fix wrong lockdep annotations	2022-06-09 10:21:03 +02:00
ntfs	ntfs: check overflow when iterating ATTR_RECORDs	2022-11-25 17:45:57 +01:00
ocfs2	ocfs2: fix BUG when iput after ocfs2_mknod fails	2022-10-30 09:41:15 +01:00
omfs	fs: omfs: use kmemdup() rather than kmalloc+memcpy	2020-09-22 23:39:45 -04:00
openpromfs
orangefs	orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()	2022-01-20 09:17:50 +01:00
overlayfs	ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh()	2022-08-21 15:15:23 +02:00
proc	mm: /proc/pid/smaps_rollup: fix no vma's null-deref	2022-10-30 09:41:19 +01:00
pstore	pstore: Don't use semaphores in always-atomic-context code	2022-04-08 14:39:56 +02:00
qnx4	qnx4: work around gcc false positive warning bug	2021-09-30 10:11:08 +02:00
qnx6	[PATCH] reduce boilerplate in fsid handling	2020-09-18 16:45:50 -04:00
quota	quota: Check next/prev free block number after reading from quota file	2022-10-26 13:25:09 +02:00
ramfs	ramfs: fix nommu mmap with gaps in the page cache	2020-10-16 11:11:22 -07:00
reiserfs	reiserfs: check directory items on read from disk	2021-08-12 13:22:19 +02:00
romfs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
squashfs	squashfs: fix divide error in calculate_skip()	2021-05-19 10:13:10 +02:00
sysfs	sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output	2020-10-02 12:02:30 +02:00
sysv	[PATCH] reduce boilerplate in fsid handling	2020-09-18 16:45:50 -04:00
tracefs	tracefs: Only clobber mode/uid/gid on remount if asked	2022-09-20 12:38:31 +02:00
ubifs	ubifs: Rectify space amount budget for mkdir/tmpfile operations	2022-04-13 21:00:53 +02:00
udf	udf: Fix a slab-out-of-bounds write bug in udf_find_entry()	2022-11-16 09:57:17 +01:00
ufs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
unicode	unicode: Add utf8_casefold_hash	2020-09-10 14:03:31 -07:00
vboxsf	vboxfs: fix broken legacy mount signature checking	2021-10-17 10:43:33 +02:00
verity	fs-verity: fix signed integer overflow with i_size near S64_MAX	2021-10-06 15:55:46 +02:00
xfs	xfs: validate inode fork size against fork format	2022-09-28 11:10:29 +02:00
zonefs	zonefs: fix zonefs_iomap_begin() for reads	2022-06-25 15:16:08 +02:00
aio.c	aio: fix use-after-free due to missing POLLFREE handling	2021-12-14 11:32:40 +01:00
anon_inodes.c
attr.c	vfs: Check the truncate maximum size in inode_newsize_ok()	2022-08-21 15:15:22 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c	coredump: Snapshot the vmas in do_coredump	2022-04-08 14:40:44 +02:00
binfmt_elf.c	fs/binfmt_elf: Fix memory leak in load_elf_binary()	2022-11-03 23:57:49 +09:00
binfmt_em86.c
binfmt_flat.c	binfmt_flat: do not stop relocating GOT entries prematurely on riscv	2022-06-09 10:20:47 +02:00
binfmt_misc.c	binfmt_misc: fix possible deadlock in bm_register_write	2021-03-17 17:06:35 +01:00
binfmt_script.c
block_dev.c	block: fix a race between del_gendisk and BLKRRPART	2021-06-03 09:00:45 +02:00
buffer.c	mm: fs: initialize fsdata passed to write_begin/write_end interface	2022-11-25 17:45:56 +01:00
char_dev.c
compat_binfmt_elf.c
coredump.c	coredump: Use the vma snapshot in fill_files_note	2022-04-08 14:40:45 +02:00
d_path.c	fs: fix NULL dereference due to data race in prepend_path()	2020-10-14 14:54:45 -07:00
dax.c	dax: fix cache flush on PMD-mapped pages	2022-06-09 10:21:16 +02:00
dcache.c	vfs: Use sequence counter with associated spinlock	2020-07-29 16:14:27 +02:00
dcookies.c
direct-io.c	fs: direct-io: fix missing sdio->boundary	2021-04-14 08:41:58 +02:00
drop_caches.c
eventfd.c
eventpoll.c	epoll: autoremove wakers even more aggressively	2022-08-21 15:15:28 +02:00
exec.c	exec: Copy oldsighand->action under spin-lock	2022-11-03 23:57:49 +09:00
fcntl.c	fcntl: fix potential deadlocks for &fown_struct.lock	2022-10-30 09:41:18 +01:00
fhandle.c
file_table.c	SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()	2022-05-18 10:23:48 +02:00
file.c	fs: fix fd table size alignment properly	2022-04-08 14:40:30 +02:00
filesystems.c
fs_context.c	memcg: charge fs_context and legacy_fs_context	2022-02-08 18:30:36 +01:00
fs_parser.c	fs_parse: mark fs_param_bad_value() as static	2020-10-13 18:38:27 -07:00
fs_pin.c
fs_struct.c	vfs: Use sequence counter with associated spinlock	2020-07-29 16:14:27 +02:00
fs_types.c
fs-writeback.c	fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages	2022-06-09 10:21:22 +02:00
fsopen.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
init.c	init: add an init_dup helper	2020-08-04 21:02:38 -04:00
inode.c	fs: fix UAF/GPF bug in nilfs_mdt_destroy	2022-10-15 07:55:51 +02:00
internal.h	cgroup1: fix leaked context root causing sporadic NULL deref in LTP	2021-07-31 08:16:11 +02:00
io_uring.c	io_uring: kill goto error handling in io_sqpoll_wait_sq()	2022-11-16 09:57:20 +01:00
io-wq.c	io-wq: fix wakeup race when adding new work	2021-09-18 13:40:06 +02:00
io-wq.h	io_uring: always batch cancel in *cancel_files()	2021-02-13 13:54:56 +01:00
ioctl.c	fs: fix an infinite loop in iomap_fiemap	2022-05-25 09:17:54 +02:00
Kconfig	tmpfs: disallow CONFIG_TMPFS_INODE64 on alpha	2021-02-17 11:02:21 +01:00
Kconfig.binfmt
kernel_read_file.c	vfs: check fd has read access in kernel_read_file_from_fd()	2021-10-27 09:56:51 +02:00
libfs.c	libfs: fix error cast of negative value in simple_attr_write()	2020-11-22 10:48:22 -08:00
locks.c	Revert "nfsd4: a client's own opens needn't prevent delegations"	2021-03-20 10:43:44 +01:00
Makefile	Refactored code for 5.10:	2020-10-23 11:33:41 -07:00
mbcache.c
mount.h
mpage.c
namei.c	mm: fs: initialize fsdata passed to write_begin/write_end interface	2022-11-25 17:45:56 +01:00
namespace.c	fs: warn about impending deprecation of mandatory locks	2021-08-26 08:35:57 -04:00
no-block.c
nsfs.c
open.c	open: don't silently ignore unknown O-flags in openat2()	2021-07-14 16:55:59 +02:00
pipe.c	pipe: Fix missing lock in pipe_resize_ring()	2022-06-06 08:42:41 +02:00
pnode.c
pnode.h	mount: fix mounting of detached mounts onto targets that reside on shared mounts	2021-03-17 17:06:13 +01:00
posix_acl.c
proc_namespace.c	proc mountinfo: make splice available again	2020-12-30 11:54:02 +01:00
read_write.c	Refactored code for 5.10:	2020-10-23 11:33:41 -07:00
readdir.c	readdir: make sure to verify directory entry for legacy interfaces too	2021-04-21 13:00:54 +02:00
remap_range.c	fs/remap: constrain dedupe of EOF blocks	2022-07-21 21:20:01 +02:00
select.c	select: Fix indefinitely sleeping task in poll_schedule_timeout()	2022-01-29 10:26:11 +01:00
seq_file.c	seq_file: disallow extremely large seq buffer allocations	2021-07-20 16:05:59 +02:00
signalfd.c	io_uring: disable polling pollfree files	2022-09-05 10:28:58 +02:00
splice.c	Revert "fs: check FMODE_LSEEK to control internal pipe splicing"	2022-10-17 17:26:07 +02:00
stack.c
stat.c	stat: fix inconsistency between struct stat and struct compat_stat	2022-04-27 13:53:54 +02:00
statfs.c	Add a "nosymfollow" mount option.	2020-08-27 16:06:47 -04:00
super.c	fscrypt: fix keyring memory leak on mount failure	2022-11-10 18:14:25 +01:00
sync.c	vfs: make sync_filesystem return errors from ->sync_fs	2022-08-31 17:15:14 +02:00
timerfd.c
userfaultfd.c	userfaultfd: open userfaultfds with O_RDONLY	2022-10-26 13:25:17 +02:00
utimes.c	fs: expose utimes_common	2020-07-31 08:16:01 +02:00
xattr.c	fs/xattr.c: fix kernel-doc warnings for setxattr & removexattr	2020-10-13 18:38:27 -07:00