9e626575d1
[ Upstream commit adc77b19f62d7e80f98400b2fca9d700d2afdd6f ] Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80 ocfs2_file_read_iter+0x9a4/0xf80 __io_read+0x8d4/0x20f0 io_read+0x3e/0xf0 io_issue_sqe+0x42b/0x22c0 io_wq_submit_work+0xaf9/0xdc0 io_worker_handle_work+0xd13/0x2110 io_wq_worker+0x447/0x1410 ret_from_fork+0x6f/0x90 ret_from_fork_asm+0x1a/0x30 Uninit was created at: __alloc_pages_noprof+0x9a7/0xe00 alloc_pages_mpol_noprof+0x299/0x990 alloc_pages_noprof+0x1bf/0x1e0 allocate_slab+0x33a/0x1250 ___slab_alloc+0x12ef/0x35e0 kmem_cache_alloc_bulk_noprof+0x486/0x1330 __io_alloc_req_refill+0x84/0x560 io_submit_sqes+0x172f/0x2f30 __se_sys_io_uring_enter+0x406/0x41c0 __x64_sys_io_uring_enter+0x11f/0x1a0 x64_sys_call+0x2b54/0x3ba0 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Since an instance of 'struct kiocb' may be passed from the block layer with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()' and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in 'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'. Link: https://lkml.kernel.org/r/20241029091736.1501946-1-dmantipov@yandex.ru Fixes: 7cdfc3a1c397 ("ocfs2: Remember rw lock level during direct io") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Reported-by: syzbot+a73e253cca4f0230a5a5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a73e253cca4f0230a5a5 Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Joseph Qi <jiangqi903@gmail.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Jun Piao <piaojun@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
82 lines
2.5 KiB
C
Executable file
82 lines
2.5 KiB
C
Executable file
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/* -*- mode: c; c-basic-offset: 8; -*-
|
|
* vim: noexpandtab sw=8 ts=8 sts=0:
|
|
*
|
|
* Copyright (C) 2002, 2004, 2005 Oracle. All rights reserved.
|
|
*/
|
|
|
|
#ifndef OCFS2_AOPS_H
|
|
#define OCFS2_AOPS_H
|
|
|
|
#include <linux/fs.h>
|
|
|
|
handle_t *ocfs2_start_walk_page_trans(struct inode *inode,
|
|
struct page *page,
|
|
unsigned from,
|
|
unsigned to);
|
|
|
|
int ocfs2_map_page_blocks(struct page *page, u64 *p_blkno,
|
|
struct inode *inode, unsigned int from,
|
|
unsigned int to, int new);
|
|
|
|
void ocfs2_unlock_and_free_pages(struct page **pages, int num_pages);
|
|
|
|
int walk_page_buffers( handle_t *handle,
|
|
struct buffer_head *head,
|
|
unsigned from,
|
|
unsigned to,
|
|
int *partial,
|
|
int (*fn)( handle_t *handle,
|
|
struct buffer_head *bh));
|
|
|
|
int ocfs2_write_end_nolock(struct address_space *mapping,
|
|
loff_t pos, unsigned len, unsigned copied, void *fsdata);
|
|
|
|
typedef enum {
|
|
OCFS2_WRITE_BUFFER = 0,
|
|
OCFS2_WRITE_DIRECT,
|
|
OCFS2_WRITE_MMAP,
|
|
} ocfs2_write_type_t;
|
|
|
|
int ocfs2_write_begin_nolock(struct address_space *mapping,
|
|
loff_t pos, unsigned len, ocfs2_write_type_t type,
|
|
struct page **pagep, void **fsdata,
|
|
struct buffer_head *di_bh, struct page *mmap_page);
|
|
|
|
int ocfs2_read_inline_data(struct inode *inode, struct page *page,
|
|
struct buffer_head *di_bh);
|
|
int ocfs2_size_fits_inline_data(struct buffer_head *di_bh, u64 new_size);
|
|
|
|
int ocfs2_get_block(struct inode *inode, sector_t iblock,
|
|
struct buffer_head *bh_result, int create);
|
|
/* all ocfs2_dio_end_io()'s fault */
|
|
#define ocfs2_iocb_is_rw_locked(iocb) \
|
|
test_bit(0, (unsigned long *)&iocb->private)
|
|
static inline void ocfs2_iocb_set_rw_locked(struct kiocb *iocb, int level)
|
|
{
|
|
set_bit(0, (unsigned long *)&iocb->private);
|
|
if (level)
|
|
set_bit(1, (unsigned long *)&iocb->private);
|
|
else
|
|
clear_bit(1, (unsigned long *)&iocb->private);
|
|
}
|
|
|
|
/*
|
|
* Using a named enum representing lock types in terms of #N bit stored in
|
|
* iocb->private, which is going to be used for communication between
|
|
* ocfs2_dio_end_io() and ocfs2_file_write/read_iter().
|
|
*/
|
|
enum ocfs2_iocb_lock_bits {
|
|
OCFS2_IOCB_RW_LOCK = 0,
|
|
OCFS2_IOCB_RW_LOCK_LEVEL,
|
|
OCFS2_IOCB_NUM_LOCKS
|
|
};
|
|
|
|
#define ocfs2_iocb_init_rw_locked(iocb) \
|
|
(iocb->private = NULL)
|
|
#define ocfs2_iocb_clear_rw_locked(iocb) \
|
|
clear_bit(OCFS2_IOCB_RW_LOCK, (unsigned long *)&iocb->private)
|
|
#define ocfs2_iocb_rw_locked_level(iocb) \
|
|
test_bit(OCFS2_IOCB_RW_LOCK_LEVEL, (unsigned long *)&iocb->private)
|
|
|
|
#endif /* OCFS2_FILE_H */
|