Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/fs
History
Thadeu Lima de Souza Cascardo b51a5d0934 hfsplus: don't query the device logical block size multiple times 
[ Upstream commit 1c82587cb57687de3f18ab4b98a8850c789bedcf ]

Devices block sizes may change. One of these cases is a loop device by
using ioctl LOOP_SET_BLOCK_SIZE.

While this may cause other issues like IO being rejected, in the case of
hfsplus, it will allocate a block by using that size and potentially write
out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the
latter function reads a different io_size.

Using a new min_io_size initally set to sb_min_blocksize works for the
purposes of the original fix, since it will be set to the max between
HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the
max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not
initialized.

Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024
and 4096.

The produced KASAN report before the fix looks like this:

[  419.944641] ==================================================================
[  419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a
[  419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678
[  419.947612]
[  419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84
[  419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
[  419.950035] Call Trace:
[  419.950384]  <TASK>
[  419.950676]  dump_stack_lvl+0x57/0x78
[  419.951212]  ? hfsplus_read_wrapper+0x659/0xa0a
[  419.951830]  print_report+0x14c/0x49e
[  419.952361]  ? __virt_addr_valid+0x267/0x278
[  419.952979]  ? kmem_cache_debug_flags+0xc/0x1d
[  419.953561]  ? hfsplus_read_wrapper+0x659/0xa0a
[  419.954231]  kasan_report+0x89/0xb0
[  419.954748]  ? hfsplus_read_wrapper+0x659/0xa0a
[  419.955367]  hfsplus_read_wrapper+0x659/0xa0a
[  419.955948]  ? __pfx_hfsplus_read_wrapper+0x10/0x10
[  419.956618]  ? do_raw_spin_unlock+0x59/0x1a9
[  419.957214]  ? _raw_spin_unlock+0x1a/0x2e
[  419.957772]  hfsplus_fill_super+0x348/0x1590
[  419.958355]  ? hlock_class+0x4c/0x109
[  419.958867]  ? __pfx_hfsplus_fill_super+0x10/0x10
[  419.959499]  ? __pfx_string+0x10/0x10
[  419.960006]  ? lock_acquire+0x3e2/0x454
[  419.960532]  ? bdev_name.constprop.0+0xce/0x243
[  419.961129]  ? __pfx_bdev_name.constprop.0+0x10/0x10
[  419.961799]  ? pointer+0x3f0/0x62f
[  419.962277]  ? __pfx_pointer+0x10/0x10
[  419.962761]  ? vsnprintf+0x6c4/0xfba
[  419.963178]  ? __pfx_vsnprintf+0x10/0x10
[  419.963621]  ? setup_bdev_super+0x376/0x3b3
[  419.964029]  ? snprintf+0x9d/0xd2
[  419.964344]  ? __pfx_snprintf+0x10/0x10
[  419.964675]  ? lock_acquired+0x45c/0x5e9
[  419.965016]  ? set_blocksize+0x139/0x1c1
[  419.965381]  ? sb_set_blocksize+0x6d/0xae
[  419.965742]  ? __pfx_hfsplus_fill_super+0x10/0x10
[  419.966179]  mount_bdev+0x12f/0x1bf
[  419.966512]  ? __pfx_mount_bdev+0x10/0x10
[  419.966886]  ? vfs_parse_fs_string+0xce/0x111
[  419.967293]  ? __pfx_vfs_parse_fs_string+0x10/0x10
[  419.967702]  ? __pfx_hfsplus_mount+0x10/0x10
[  419.968073]  legacy_get_tree+0x104/0x178
[  419.968414]  vfs_get_tree+0x86/0x296
[  419.968751]  path_mount+0xba3/0xd0b
[  419.969157]  ? __pfx_path_mount+0x10/0x10
[  419.969594]  ? kmem_cache_free+0x1e2/0x260
[  419.970311]  do_mount+0x99/0xe0
[  419.970630]  ? __pfx_do_mount+0x10/0x10
[  419.971008]  __do_sys_mount+0x199/0x1c9
[  419.971397]  do_syscall_64+0xd0/0x135
[  419.971761]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  419.972233] RIP: 0033:0x7c3cb812972e
[  419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48
[  419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5
[  419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e
[  419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: 00007ffe306325d0
[  419.976363] RBP: 00007ffe30632720 R08: 00007ffe30632610 R09: 0000000000000000
[  419.977034] R10: 0000000000200008 R11: 0000000000000286 R12: 0000000000000000
[  419.977713] R13: 00007ffe306328e8 R14: 00005a0eb298bc68 R15: 00007c3cb8356000
[  419.978375]  </TASK>
[  419.978589]

Fixes: 6596528e391a ("hfsplus: ensure bio requests are not smaller than the hardware sectors")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Link: https://lore.kernel.org/r/20241107114109.839253-1-cascardo@igalia.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-12-17 13:23:59 +01:00
..
9p fs/9p: drop inodes immediately on non-.L too 2024-11-19 11:32:45 +01:00
adfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
affs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
afs afs: Don't cross .backup mountpoint from backup volume 2024-11-19 12:27:12 +01:00
autofs Revert "file: Replace ksys_close with close_fd" 2024-11-19 12:59:08 +01:00
befs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
btrfs btrfs: reinitialize delayed ref list after deleting it from the list 2024-11-30 02:33:25 +01:00
cachefiles Revert "namei: introduce struct renamedata" 2024-11-19 13:45:08 +01:00
ceph Revert "ceph: remove the incorrect Fw reference check when dirtying pages" 2024-11-24 00:23:13 +01:00
cifs cifs: Fix buffer overflow when parsing NFS reparse points 2024-12-17 13:23:58 +01:00
coda Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
configfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cramfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
crypto Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
debugfs debugfs: fix automount d_fsdata usage 2024-11-18 12:12:12 +01:00
devpts Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dlm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ecryptfs Revert "namei: introduce struct renamedata" 2024-11-19 13:45:08 +01:00
efivarfs efivarfs: force RO when remounting if SetVariable is not supported 2024-11-18 12:12:25 +01:00
efs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
erofs BACKPORT: erofs: fix lz4 inplace decompression 2024-11-17 17:41:30 +01:00
exfat Revert "exfat: fix memory leak in exfat_load_bitmap()" 2024-11-24 00:23:02 +01:00
exportfs exportfs: use pr_debug for unreachable debug statements 2024-11-19 12:28:26 +01:00
ext2 ext2: Verify bitmap and itable block numbers before using them 2024-11-23 23:20:12 +01:00
ext4 Revert "ext4: handle redirtying in ext4_bio_write_page()" 2024-11-24 00:23:46 +01:00
f2fs Revert "f2fs: fix to update i_ctime in __f2fs_setxattr()" 2024-11-24 00:23:20 +01:00
fat Revert "fat: fix uninitialized variable" 2024-11-24 00:22:53 +01:00
freevxfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fscache Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fuse Revert "virtiofs: forbid newlines in tags" 2024-11-24 00:23:52 +01:00
gfs2 gfs2: setattr_chown: Add missing initialization 2024-11-23 23:20:45 +01:00
hfs hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() 2024-11-23 23:20:12 +01:00
hfsplus hfsplus: don't query the device logical block size multiple times 2024-12-17 13:23:59 +01:00
hostfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hpfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hugetlbfs fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super 2024-11-18 23:18:30 +01:00
incfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iomap iomap: update ki_pos a little later in iomap_dio_complete 2024-11-23 23:22:00 +01:00
isofs isofs: handle CDs with bad root inode but good Joliet root directory 2024-11-19 09:23:14 +01:00
jbd2 Revert "ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()" 2024-11-24 00:23:04 +01:00
jffs2 jffs2: Fix potential illegal address access in jffs2_free_inode 2024-11-19 14:19:41 +01:00
jfs Revert "jfs: UBSAN: shift-out-of-bounds in dbFindBits" 2024-11-24 00:23:06 +01:00
kernfs fs/kernfs/dir: obey S_ISGID 2024-11-18 12:13:20 +01:00
lockd Revert "nfsd: stop setting ->pg_stats for unused stats" 2024-11-24 00:23:44 +01:00
minix Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nfs nfs: Fix KMSAN warning in decode_getfattr_attrs() 2024-11-30 02:33:25 +01:00
nfs_common NFSD: Add an xdr_stream-based encoder for NFSv2/3 ACLs 2024-11-19 12:27:35 +01:00
nfsd NFSD: Never decrement pending_async_copies on error 2024-12-17 13:20:51 +01:00
nilfs2 nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint 2024-12-17 13:20:51 +01:00
nls Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
notify Revert "fsnotify: clear PARENT_WATCHED flags lazily" 2024-11-24 00:23:48 +01:00
ntfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ocfs2 ocfs2: fix UBSAN warning in ocfs2_verify_volume() 2024-12-17 13:20:51 +01:00
omfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
openpromfs openpromfs: finish conversion to the new mount API 2024-11-19 12:26:52 +01:00
orangefs orangefs: fix out-of-bounds fsid access 2024-11-19 14:19:41 +01:00
overlayfs ovl: Filter invalid inodes with missing lookup function 2024-12-17 13:20:50 +01:00
proc proc/softirqs: replace seq_printf with seq_put_decimal_ull_width 2024-12-17 13:23:58 +01:00
pstore pstore/zone: Add a null pointer check to the psz_kmsg_read 2024-11-19 09:23:13 +01:00
qnx4 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
qnx6 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
quota quota: Remove BUG_ON from dqget() 2024-11-23 23:20:45 +01:00
ramfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reiserfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
romfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sdfat Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
squashfs Revert "Squashfs: sanity check symbolic link size" 2024-11-24 00:23:38 +01:00
sysfs fs: sysfs: Fix reference leak in sysfs_break_active_protection() 2024-11-19 11:32:23 +01:00
sysv sysv: don't call sb_bread() with pointers_lock held 2024-11-19 09:23:14 +01:00
tracefs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ubifs ubifs: Set page uptodate in the correct place 2024-11-19 09:22:16 +01:00
udf Revert "udf: Limit file size to 4TB" 2024-11-24 00:23:46 +01:00
ufs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
unicode Revert "unicode: Don't special case ignorable code points" 2024-11-24 00:23:00 +01:00
vboxsf vboxsf: Avoid an spurious warning if load_nls_xxx() fails 2024-11-19 09:22:46 +01:00
verity Revert "fs: add file and path permissions helpers" 2024-11-19 13:30:21 +01:00
xfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
zonefs zonefs: Improve error handling 2024-11-18 22:25:32 +01:00
aio.c fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion 2024-11-19 09:22:39 +01:00
anon_inodes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
attr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bad_inode.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_aout.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_elf.c binfmt_misc: pass binfmt_misc flags to the interpreter 2024-11-23 23:20:49 +01:00
binfmt_elf_fdpic.c binfmt_misc: pass binfmt_misc flags to the interpreter 2024-11-23 23:20:49 +01:00
binfmt_em86.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_flat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
binfmt_misc.c binfmt_misc: pass binfmt_misc flags to the interpreter 2024-11-23 23:20:49 +01:00
binfmt_script.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
block_dev.c block: Don't invalidate pagecache for invalid falloc modes 2024-11-18 12:12:06 +01:00
buffer.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
char_dev.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
compat_binfmt_elf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
coredump.c exec: Simplify unshare_files 2024-11-19 12:27:27 +01:00
d_path.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dax.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dcache.c fs: better handle deep ancestor chains in is_subdir() 2024-11-19 14:19:50 +01:00
dcookies.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
direct-io.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dlog_hook.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drop_caches.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eventfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eventpoll.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
exec.c Revert "parisc: Fix stack start for ADDR_NO_RANDOMIZE personality" 2024-11-24 00:23:03 +01:00
fcntl.c Revert "fs: Fix file_set_fowner LSM hook inconsistencies" 2024-11-24 00:23:15 +01:00
fhandle.c do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak 2024-11-19 08:44:37 +01:00
file.c fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE 2024-11-23 23:20:42 +01:00
file_table.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
filesystems.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs-writeback.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_context.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_parser.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_pin.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_struct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fs_types.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fsopen.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
init.c Revert "fs: add file and path permissions helpers" 2024-11-19 13:30:21 +01:00
inode.c Revert "vfs: fix race between evice_inodes() and find_inode()&iput()" 2024-11-24 00:23:15 +01:00
internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ioctl.c lsm: new security_file_ioctl_compat() hook 2024-11-18 12:12:58 +01:00
Kconfig NFSD: Remove CONFIG_NFSD_V3 2024-11-19 12:27:54 +01:00
Kconfig.binfmt Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kernel_read_file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
libfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
locks.c filelock: Fix fcntl/close race recovery compat path 2024-11-19 14:19:53 +01:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mbcache.c mbcache: Speed up cache entry creation 2024-11-19 17:58:19 +01:00
mount.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mpage.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
namei.c Revert "namei: introduce struct renamedata" 2024-11-19 13:45:08 +01:00
namespace.c Revert "mount: warn only once about timestamp range expiration" 2024-11-24 00:23:31 +01:00
no-block.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nsfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
open.c openat2: explicitly return -E2BIG for (usize > PAGE_SIZE) 2024-11-23 23:22:01 +01:00
pipe.c pipe: wakeup wr_wait after setting max_usage 2024-11-18 12:13:04 +01:00
pnode.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pnode.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
posix_acl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
proc_namespace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
read_write.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
readdir.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
remap_range.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
select.c fs/select: rework stack allocation hack for clang 2024-11-19 08:44:37 +01:00
seq_file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
signalfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
splice.c splice: don't generate zero-len segement bvecs 2024-11-19 17:42:24 +01:00
stack.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
statfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
super.c Revert "fs: explicitly unregister per-superblock BDIs" 2024-11-24 00:23:31 +01:00
sync.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
timerfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
userfaultfd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
utimes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xattr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00