Zhang Yi
fba5428917
ext4: add reserved GDT blocks check ...
commit b55c3cd102a6f48b90e61c44f7f3dda8c290c694 upstream.
We capture a NULL pointer issue when resizing a corrupt ext4 image which
is freshly clear resize_inode feature (not run e2fsck). It could be
simply reproduced by following steps. The problem is because of the
resize_inode feature was cleared, and it will convert the filesystem to
meta_bg mode in ext4_resize_fs(), but the es->s_reserved_gdt_blocks was
not reduced to zero, so could we mistakenly call reserve_backup_gdb()
and passing an uninitialized resize_inode to it when adding new group
descriptors.
mkfs.ext4 /dev/sda 3G
tune2fs -O ^resize_inode /dev/sda #forget to run requested e2fsck
mount /dev/sda /mnt
resize2fs /dev/sda 8G
========
BUG: kernel NULL pointer dereference, address: 0000000000000028
CPU: 19 PID: 3243 Comm: resize2fs Not tainted 5.18.0-rc7-00001-gfde086c5ebfd #748
...
RIP: 0010:ext4_flex_group_add+0xe08/0x2570
...
Call Trace:
<TASK>
ext4_resize_fs+0xbec/0x1660
__ext4_ioctl+0x1749/0x24e0
ext4_ioctl+0x12/0x20
__x64_sys_ioctl+0xa6/0x110
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f2dd739617b
========
The fix is simple, add a check in ext4_resize_begin() to make sure that
the es->s_reserved_gdt_blocks is zero when the resize_inode feature is
disabled.
Cc: stable@kernel.org
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Ritesh Harjani <ritesh.list@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20220601092717.763694-1-yi.zhang@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-22 14:11:23 +02:00
9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"
2022-06-22 14:11:02 +02:00
afs: Fix infinite loop found by xfstest generic/676
2022-06-14 18:11:55 +02:00
btrfs: repair super block num_devices automatically
2022-06-14 18:11:24 +02:00
ceph: allow ceph.dir.rctime xattr to be updatable
2022-06-14 18:12:01 +02:00
cifs: return errors during session setup during reconnects
2022-06-14 18:12:02 +02:00
configfs: fix a race in configfs_{,un}register_subsystem()
2022-03-02 11:41:10 +01:00
fscrypt: add fscrypt_symlink_getattr() for computing st_size
2021-09-12 08:56:38 +02:00
debugfs: lockdown: Allow reading debugfs files that are not world readable
2022-01-27 09:19:36 +01:00
fsnotify: fix fsnotify hooks in pseudo filesystems
2022-02-01 17:24:34 +01:00
dlm: fix missing lkb refcount handling
2022-06-14 18:11:46 +02:00
erofs: fix unsafe pagevec reuse of hooked pclusters
2021-11-21 13:38:51 +01:00
ext2: correct max file size computing
2022-04-15 14:18:13 +02:00
ext4: add reserved GDT blocks check
2022-06-22 14:11:23 +02:00
f2fs: remove WARN_ON in f2fs_is_valid_blkaddr
2022-06-14 18:11:56 +02:00
fat: add ratelimit to fat*_ent_bread()
2022-06-14 18:11:30 +02:00
fscache: Fix cookie key hashing
2021-09-22 12:26:25 +02:00
fuse: fix pipe buffer lifetime for direct_io
2022-03-16 13:21:47 +01:00
gfs2: Fix filesystem block deallocation for short writes
2022-05-18 09:47:26 +02:00
hfs: add lock nesting notation to hfs_find_init
2021-07-31 08:19:38 +02:00
mm, hugetlb: allow for "high" userspace addresses
2022-05-09 09:03:28 +02:00
iomap: iomap_write_failed fix
2022-06-14 18:11:36 +02:00
isofs: Fix out of bound access for corrupted isofs image
2021-11-12 14:43:03 +01:00
jbd2: fix a potential race while discarding reserved buffers after an abort
2022-04-27 13:50:50 +02:00
jffs2: fix memory leak in jffs2_do_fill_super
2022-06-14 18:11:55 +02:00
fs: jfs: fix possible NULL pointer dereference in dbFree()
2022-06-14 18:11:29 +02:00
kernfs: Separate kernfs_pr_cont_buf and rename_lock.
2022-06-14 18:12:00 +02:00
lockd: lockd server-side shouldn't set fl_ops
2021-09-22 12:26:34 +02:00
minix: fix bug when opening a file with O_DIRECT
2022-04-15 14:18:35 +02:00
pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE
2022-06-22 14:11:21 +02:00
NFSD: Fix possible sleep during nfsd4_release_lockowner()
2022-06-06 08:33:51 +02:00
nilfs2: fix lockdep warnings during disk space reclamation
2022-05-25 09:14:33 +02:00
fsnotify: fix wrong lockdep annotations
2022-06-14 18:11:34 +02:00
ntfs: add sanity check on allocation size
2022-04-15 14:18:23 +02:00
ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
2022-06-14 18:11:46 +02:00
orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()
2022-01-20 09:19:17 +01:00
ovl: fix warning in ovl_create_real()
2021-12-22 09:29:40 +01:00
proc: fix dentry/inode overinstantiating under /proc/${pid}/net
2022-06-14 18:11:41 +02:00
qnx4: work around gcc false positive warning bug
2021-09-30 10:09:26 +02:00
quota: make dquot_quota_sync return errors from ->sync_fs
2022-02-23 11:59:55 +01:00
reiserfs: check directory items on read from disk
2021-08-12 13:21:05 +02:00
tracefs: Set the group ownership in apply_options() not parse_options()
2022-03-02 11:41:13 +01:00
ubifs: Rectify space amount budget for mkdir/tmpfile operations
2022-04-15 14:18:31 +02:00
udf: Fix NULL ptr deref when converting from inline format
2022-02-01 17:24:34 +01:00
fs-verity: fix signed integer overflow with i_size near S64_MAX
2021-10-06 15:42:30 +02:00
xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
2022-01-11 15:23:32 +01:00
aio: fix use-after-free due to missing POLLFREE handling
2021-12-14 14:49:02 +01:00
elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings
2021-10-06 15:42:35 +02:00
binfmt_flat: do not stop relocating GOT entries prematurely on riscv
2022-06-14 18:11:23 +02:00
compat_ioctl: remove /dev/random commands
2022-06-22 14:11:03 +02:00
dax: fix cache flush on PMD-mapped pages
2022-06-14 18:11:41 +02:00
exec: Force single empty string when argv is empty
2022-06-06 08:33:50 +02:00
fcntl: fix potential deadlock for &fasync_struct.fa_lock
2021-09-15 09:47:28 +02:00
fget: clarify and improve __fget_files() implementation
2022-03-02 11:41:18 +01:00
SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
2022-05-25 09:14:34 +02:00
fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages
2022-06-14 18:11:44 +02:00
memcg: charge fs_context and legacy_fs_context
2022-02-08 18:24:29 +01:00
cgroup1: fix leaked context root causing sporadic NULL deref in LTP
2021-07-31 08:19:37 +02:00
io_uring: fix fs->users overflow
2022-04-15 14:18:41 +02:00
fsnotify: invalidate dcache before IN_DELETE event
2022-02-01 17:24:39 +01:00
fs: warn about impending deprecation of mandatory locks
2021-08-26 08:36:22 -04:00
pipe: increase minimum default pipe size to 2 pages
2021-08-12 13:21:02 +02:00
select: Fix indefinitely sleeping task in poll_schedule_timeout()
2022-01-29 10:25:11 +01:00
seq_file: disallow extremely large seq buffer allocations
2021-07-20 16:10:54 +02:00
signalfd: use wake_up_pollfree()
2021-12-14 14:49:02 +01:00
stat: fix inconsistency between struct stat and struct compat_stat
2022-04-27 13:50:48 +02:00
vfs: make freeze_super abort when sync_filesystem returns error
2022-02-23 11:59:55 +01:00
userfaultfd: prevent concurrent API initialization
2021-09-22 12:26:26 +02:00
fba5428917