Alessandro Zanni
da4803a973
fs: Fix uninitialized value issue in from_kuid and from_kgid
...
[ Upstream commit 15f34347481648a567db67fb473c23befb796af5 ]
ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in
a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set.
Initialize all fields of newattrs to avoid uninitialized variables, by
checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.
Reported-by: syzbot+6c55f725d1bdc8c52058@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6c55f725d1bdc8c52058
Signed-off-by: Alessandro Zanni <alessandro.zanni87@gmail.com>
Link: https://lore.kernel.org/r/20241017120553.55331-1-alessandro.zanni87@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-30 02:33:28 +01:00
Andrew Kanner
940968132d
ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
...
commit 0b63c0e01fba40e3992bc627272ec7b618ccaef7 upstream.
Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove():
[ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12
[ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry
[ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004
[...]
[ 57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0
[...]
[ 57.331328] Call Trace:
[ 57.331477] <TASK>
[...]
[ 57.333511] ? do_user_addr_fault+0x3e5/0x740
[ 57.333778] ? exc_page_fault+0x70/0x170
[ 57.334016] ? asm_exc_page_fault+0x2b/0x30
[ 57.334263] ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10
[ 57.334596] ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0
[ 57.334913] ocfs2_xa_remove_entry+0x23/0xc0
[ 57.335164] ocfs2_xa_set+0x704/0xcf0
[ 57.335381] ? _raw_spin_unlock+0x1a/0x40
[ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20
[ 57.335915] ? trace_preempt_on+0x1e/0x70
[ 57.336153] ? start_this_handle+0x16c/0x500
[ 57.336410] ? preempt_count_sub+0x50/0x80
[ 57.336656] ? _raw_read_unlock+0x20/0x40
[ 57.336906] ? start_this_handle+0x16c/0x500
[ 57.337162] ocfs2_xattr_block_set+0xa6/0x1e0
[ 57.337424] __ocfs2_xattr_set_handle+0x1fd/0x5d0
[ 57.337706] ? ocfs2_start_trans+0x13d/0x290
[ 57.337971] ocfs2_xattr_set+0xb13/0xfb0
[ 57.338207] ? dput+0x46/0x1c0
[ 57.338393] ocfs2_xattr_trusted_set+0x28/0x30
[ 57.338665] ? ocfs2_xattr_trusted_set+0x28/0x30
[ 57.338948] __vfs_removexattr+0x92/0xc0
[ 57.339182] __vfs_removexattr_locked+0xd5/0x190
[ 57.339456] ? preempt_count_sub+0x50/0x80
[ 57.339705] vfs_removexattr+0x5f/0x100
[...]
Reproducer uses faultinject facility to fail ocfs2_xa_remove() ->
ocfs2_xa_value_truncate() with -ENOMEM.
In this case the comment mentions that we can return 0 if
ocfs2_xa_cleanup_value_truncate() is going to wipe the entry
anyway. But the following 'rc' check is wrong and execution flow do
'ocfs2_xa_remove_entry(loc);' twice:
* 1st: in ocfs2_xa_cleanup_value_truncate();
* 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'.
Fix this by skipping the 2nd removal of the same entry and making
syzkaller repro happy.
Link: https://lkml.kernel.org/r/20241103193845.2940988-1-andrew.kanner@gmail.com
Fixes: 399ff3a748cf ("ocfs2: Handle errors while setting external xattr values.")
Signed-off-by: Andrew Kanner <andrew.kanner@gmail.com>
Reported-by: syzbot+386ce9e60fa1b18aac5b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/671e13ab.050a0220.2b8c0f.01d0.GAE@google.com/T/
Tested-by: syzbot+386ce9e60fa1b18aac5b@syzkaller.appspotmail.com
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-30 02:33:26 +01:00
Qi Xi
1f415e0144
fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
...
commit b8ee299855f08539e04d6c1a6acb3dc9e5423c00 upstream.
When build with !CONFIG_MMU, the variable 'vmcore_mmap_ops'
is defined but not used:
>> fs/proc/vmcore.c:458:42: warning: unused variable 'vmcore_mmap_ops'
458 | static const struct vm_operations_struct vmcore_mmap_ops = {
Fix this by only defining it when CONFIG_MMU is enabled.
Link: https://lkml.kernel.org/r/20241101034803.9298-1-xiqi2@huawei.com
Fixes: 9cb218131de1 ("vmcore: introduce remap_oldmem_pfn_range()")
Signed-off-by: Qi Xi <xiqi2@huawei.com>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/lkml/202410301936.GcE8yUos-lkp@intel.com/
Cc: Baoquan He <bhe@redhat.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Wang ShaoBo <bobo.shaobowang@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-30 02:33:26 +01:00
Filipe Manana
506bbb9474
btrfs: reinitialize delayed ref list after deleting it from the list
...
commit c9a75ec45f1111ef530ab186c2a7684d0a0c9245 upstream.
At insert_delayed_ref() if we need to update the action of an existing
ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head's
ref_add_list using list_del(), which leaves the ref's add_list member
not reinitialized, as list_del() sets the next and prev members of the
list to LIST_POISON1 and LIST_POISON2, respectively.
If later we end up calling drop_delayed_ref() against the ref, which can
happen during merging or when destroying delayed refs due to a transaction
abort, we can trigger a crash since at drop_delayed_ref() we call
list_empty() against the ref's add_list, which returns false since
the list was not reinitialized after the list_del() and as a consequence
we call list_del() again at drop_delayed_ref(). This results in an
invalid list access since the next and prev members are set to poison
pointers, resulting in a splat if CONFIG_LIST_HARDENED and
CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences
otherwise.
So fix this by deleting from the list with list_del_init() instead.
Fixes: 1d57ee941692 ("btrfs: improve delayed refs iterations")
CC: stable@vger.kernel.org # 4.19+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-30 02:33:25 +01:00
Roberto Sassu
b55da2e129
nfs: Fix KMSAN warning in decode_getfattr_attrs()
...
commit dc270d7159699ad6d11decadfce9633f0f71c1db upstream.
Fix the following KMSAN warning:
CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G B
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)
=====================================================
=====================================================
BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90
decode_getfattr_attrs+0x2d6d/0x2f90
decode_getfattr_generic+0x806/0xb00
nfs4_xdr_dec_getattr+0x1de/0x240
rpcauth_unwrap_resp_decode+0xab/0x100
rpcauth_unwrap_resp+0x95/0xc0
call_decode+0x4ff/0xb50
__rpc_execute+0x57b/0x19d0
rpc_execute+0x368/0x5e0
rpc_run_task+0xcfe/0xee0
nfs4_proc_getattr+0x5b5/0x990
__nfs_revalidate_inode+0x477/0xd00
nfs_access_get_cached+0x1021/0x1cc0
nfs_do_access+0x9f/0xae0
nfs_permission+0x1e4/0x8c0
inode_permission+0x356/0x6c0
link_path_walk+0x958/0x1330
path_lookupat+0xce/0x6b0
filename_lookup+0x23e/0x770
vfs_statx+0xe7/0x970
vfs_fstatat+0x1f2/0x2c0
__se_sys_newfstatat+0x67/0x880
__x64_sys_newfstatat+0xbd/0x120
x64_sys_call+0x1826/0x3cf0
do_syscall_64+0xd0/0x1b0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The KMSAN warning is triggered in decode_getfattr_attrs(), when calling
decode_attr_mdsthreshold(). It appears that fattr->mdsthreshold is not
initialized.
Fix the issue by initializing fattr->mdsthreshold to NULL in
nfs_fattr_init().
Cc: stable@vger.kernel.org # v3.5.x
Fixes: 88034c3d88c2 ("NFSv4.1 mdsthreshold attribute xdr")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-30 02:33:25 +01:00
Ksawlii
c193da6e53
Revert "virtiofs: forbid newlines in tags"
...
This reverts commit e07d94ea1d
2024-11-24 00:23:52 +01:00
Ksawlii
254706192f
Revert "fsnotify: clear PARENT_WATCHED flags lazily"
...
This reverts commit 887fdf24d2
2024-11-24 00:23:48 +01:00
Ksawlii
bbcbbc3b23
Revert "udf: Limit file size to 4TB"
...
This reverts commit db611d177b
2024-11-24 00:23:46 +01:00
Ksawlii
e254363d4c
Revert "ext4: handle redirtying in ext4_bio_write_page()"
...
This reverts commit 952c89ac51
2024-11-24 00:23:46 +01:00
Ksawlii
4a63b68b74
Revert "NFSD: Refactor nfsd_reply_cache_free_locked()"
...
This reverts commit 06ca7ef647
2024-11-24 00:23:45 +01:00
Ksawlii
7232cc0acc
Revert "NFSD: Rename nfsd_reply_cache_alloc()"
...
This reverts commit bf9e2edffb
2024-11-24 00:23:45 +01:00
Ksawlii
679a5499d6
Revert "NFSD: Replace nfsd_prune_bucket()"
...
This reverts commit 11242ff0bf
2024-11-24 00:23:45 +01:00
Ksawlii
a77ba247a7
Revert "NFSD: Refactor the duplicate reply cache shrinker"
...
This reverts commit ddc87a28f9
2024-11-24 00:23:45 +01:00
Ksawlii
370fd3e8ce
Revert "NFSD: simplify error paths in nfsd_svc()"
...
This reverts commit 3890c7c53c
2024-11-24 00:23:45 +01:00
Ksawlii
6d767ecd3e
Revert "NFSD: Rewrite synopsis of nfsd_percpu_counters_init()"
...
This reverts commit b26ad58084
2024-11-24 00:23:45 +01:00
Ksawlii
18f77282d9
Revert "NFSD: Fix frame size warning in svc_export_parse()"
...
This reverts commit 2f282ed1a9
2024-11-24 00:23:45 +01:00
Ksawlii
ac304417cc
Revert "nfsd: stop setting ->pg_stats for unused stats"
...
This reverts commit 1f1c36f524
2024-11-24 00:23:44 +01:00
Ksawlii
181d28ae2b
Revert "sunrpc: pass in the sv_stats struct through svc_create_pooled"
...
This reverts commit bdc4a7b40a
2024-11-24 00:23:44 +01:00
Ksawlii
279ec1c17f
Revert "sunrpc: remove ->pg_stats from svc_program"
...
This reverts commit 2f7108a6c4
2024-11-24 00:23:44 +01:00
Ksawlii
06b45d7dd6
Revert "nfsd: rename NFSD_NET_* to NFSD_STATS_*"
...
This reverts commit 4004e4dc9d
2024-11-24 00:23:44 +01:00
Ksawlii
7dd81aa9d2
Revert "nfsd: expose /proc/net/sunrpc/nfsd in net namespaces"
...
This reverts commit cc1ec49fa8
2024-11-24 00:23:44 +01:00
Ksawlii
2a0e4e700f
Revert "nfsd: make all of the nfsd stats per-network namespace"
...
This reverts commit 8e153e6f02
2024-11-24 00:23:43 +01:00
Ksawlii
e7983f03a7
Revert "nfsd: remove nfsd_stats, make th_cnt a global counter"
...
This reverts commit 32028a262e
2024-11-24 00:23:43 +01:00
Ksawlii
d494229215
Revert "nfsd: make svc_stat per-network namespace instead of global"
...
This reverts commit 886f600c8d
2024-11-24 00:23:43 +01:00
Ksawlii
4bd71292a1
Revert "udf: Avoid excessive partition lengths"
...
This reverts commit 53de2c2b51
2024-11-24 00:23:43 +01:00
Ksawlii
a82373ed36
Revert "btrfs: replace BUG_ON with ASSERT in walk_down_proc()"
...
This reverts commit 833703b1be
2024-11-24 00:23:39 +01:00
Ksawlii
9dfd5971af
Revert "btrfs: clean up our handling of refs == 0 in snapshot delete"
...
This reverts commit c6dfc73da3
2024-11-24 00:23:39 +01:00
Ksawlii
1944f01920
Revert "btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry()"
...
This reverts commit ccb6b6363d
2024-11-24 00:23:39 +01:00
Ksawlii
367c3c0607
Revert "Squashfs: sanity check symbolic link size"
...
This reverts commit 56685ee756
2024-11-24 00:23:38 +01:00
Ksawlii
223197c81f
Revert "NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations"
...
This reverts commit 3f033e95e7
2024-11-24 00:23:38 +01:00
Ksawlii
2a04905087
Revert "nilfs2: replace snprintf in show functions with sysfs_emit"
...
This reverts commit bd580a7fd9
2024-11-24 00:23:37 +01:00
Ksawlii
acfc7f60d9
Revert "nilfs2: protect references to superblock parameters exposed in sysfs"
...
This reverts commit 29b2aeb40d
2024-11-24 00:23:37 +01:00
Ksawlii
495ede5554
Revert "btrfs: update target inode's ctime on unlink"
...
This reverts commit 0bc0b0b3e1
2024-11-24 00:23:35 +01:00
Ksawlii
e4328eacde
Revert "NFS: Avoid unnecessary rescanning of the per-server delegation list"
...
This reverts commit bf7d380b4c
2024-11-24 00:23:35 +01:00
Ksawlii
ea2eef284d
Revert "ocfs2: add bounds checking to ocfs2_xattr_find_entry()"
...
This reverts commit 9f8e960daa
2024-11-24 00:23:33 +01:00
Ksawlii
288d6adf78
Revert "ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()"
...
This reverts commit e5a4f3990a
2024-11-24 00:23:32 +01:00
Ksawlii
f45a13db54
Revert "fs: explicitly unregister per-superblock BDIs"
...
This reverts commit 716f0f8e49
2024-11-24 00:23:31 +01:00
Ksawlii
fd797305e8
Revert "mount: warn only once about timestamp range expiration"
...
This reverts commit c9b4f8d73e
2024-11-24 00:23:31 +01:00
Ksawlii
9ba56941a6
Revert "fs/namespace: fnic: Switch to use %ptTd"
...
This reverts commit 7c72670e6a
2024-11-24 00:23:31 +01:00
Ksawlii
a9b3c9fff3
Revert "mount: handle OOM on mnt_warn_timestamp_expiry"
...
This reverts commit 3e27e86884
2024-11-24 00:23:31 +01:00
Ksawlii
a83bba270c
Revert "ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard"
...
This reverts commit 2305ff5e44
2024-11-24 00:23:23 +01:00
Ksawlii
84c804134c
Revert "ext4: avoid buffer_head leak in ext4_mark_inode_used()"
...
This reverts commit 4e2ca3b317
2024-11-24 00:23:23 +01:00
Ksawlii
1b82c86b6e
Revert "ext4: avoid potential buffer_head leak in __ext4_new_inode()"
...
This reverts commit 919de34d5e
2024-11-24 00:23:23 +01:00
Ksawlii
edcb108ec3
Revert "ext4: avoid negative min_clusters in find_group_orlov()"
...
This reverts commit aa2552d473
2024-11-24 00:23:22 +01:00
Ksawlii
484646c44e
Revert "ext4: return error on ext4_find_inline_entry"
...
This reverts commit 84e6545d45
2024-11-24 00:23:22 +01:00
Ksawlii
c3584f20ca
Revert "nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()"
...
This reverts commit 8bb2d85f57
2024-11-24 00:23:22 +01:00
Ksawlii
83721b0c9f
Revert "nilfs2: determine empty node blocks as corrupted"
...
This reverts commit d436afe369
2024-11-24 00:23:22 +01:00
Ksawlii
50c89bbfce
Revert "nilfs2: fix potential oob read in nilfs_btree_check_delete()"
...
This reverts commit 4bb27977a9
2024-11-24 00:23:22 +01:00
Ksawlii
1bde9f1a58
Revert "nfsd: remove unneeded EEXIST error check in nfsd_do_file_acquire"
...
This reverts commit 047ae79564
2024-11-24 00:23:21 +01:00
Ksawlii
4e72477dc9
Revert "nfsd: fix refcount leak when file is unhashed after being found"
...
This reverts commit 5d70e0c71b
2024-11-24 00:23:21 +01:00
