A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-06 03:45:24 -04:00
Code Issues Projects Releases Packages Wiki Activity
android_kernel_motorola_sm6375/fs
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Dylan Wolff 0d50231d47 jfs: Fix null-ptr-deref in jfs_ioc_trim 
[ Upstream commit a4685408ff6c3e2af366ad9a7274f45ff3f394ee ]

[ Syzkaller Report ]

Oops: general protection fault, probably for non-canonical address
0xdffffc0000000087: 0000 [#1
KASAN: null-ptr-deref in range [0x0000000000000438-0x000000000000043f]
CPU: 2 UID: 0 PID: 10614 Comm: syz-executor.0 Not tainted
6.13.0-rc6-gfbfd64d25c7a-dirty #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Sched_ext: serialise (enabled+all), task: runnable_at=-30ms
RIP: 0010:jfs_ioc_trim+0x34b/0x8f0
Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93
90 82 fe ff 4c 89 ff 31 f6
RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206
RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000
R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438
FS:  00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
? __die_body+0x61/0xb0
? die_addr+0xb1/0xe0
? exc_general_protection+0x333/0x510
? asm_exc_general_protection+0x26/0x30
? jfs_ioc_trim+0x34b/0x8f0
jfs_ioctl+0x3c8/0x4f0
? __pfx_jfs_ioctl+0x10/0x10
? __pfx_jfs_ioctl+0x10/0x10
__se_sys_ioctl+0x269/0x350
? __pfx___se_sys_ioctl+0x10/0x10
? do_syscall_64+0xfb/0x210
do_syscall_64+0xee/0x210
? syscall_exit_to_user_mode+0x1e0/0x330
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe51f4903ad
Code: c3 e8 a7 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d
RSP: 002b:00007fe5202250c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fe51f5cbf80 RCX: 00007fe51f4903ad
RDX: 0000000020000680 RSI: 00000000c0185879 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe520225640
R13: 000000000000000e R14: 00007fe51f44fca0 R15: 00007fe52021d000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:jfs_ioc_trim+0x34b/0x8f0
Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93
90 82 fe ff 4c 89 ff 31 f6
RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206
RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a
RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000
R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438
FS:  00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Kernel panic - not syncing: Fatal exception

[ Analysis ]

We believe that we have found a concurrency bug in the `fs/jfs` module
that results in a null pointer dereference. There is a closely related
issue which has been fixed:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234

... but, unfortunately, the accepted patch appears to still be
susceptible to a null pointer dereference under some interleavings.

To trigger the bug, we think that `JFS_SBI(ipbmap->i_sb)->bmap` is set
to NULL in `dbFreeBits` and then dereferenced in `jfs_ioc_trim`. This
bug manifests quite rarely under normal circumstances, but is
triggereable from a syz-program.

Reported-and-tested-by: Dylan J. Wolff<wolffd@comp.nus.edu.sg>
Reported-and-tested-by: Jiacheng Xu <stitch@zju.edu.cn>
Signed-off-by: Dylan J. Wolff<wolffd@comp.nus.edu.sg>
Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-06-27 11:02:54 +01:00
..
9p fs/9p: drop inodes immediately on non-.L too 2024-05-17 11:43:53 +02:00
adfs
affs affs: don't write overlarge OFS data block size fields 2025-04-10 14:29:42 +02:00
afs afs: Fix directory format encoding struct 2025-03-13 12:42:52 +01:00
autofs autofs: fix memory leak of waitqueues in autofs_catatonic_mode 2023-09-23 11:00:02 +02:00
befs
bfs
btrfs btrfs: send: return -ENAMETOOLONG when attempting a path that is too long 2025-06-04 14:32:30 +02:00
cachefiles cachefiles: fix memory leak in cachefiles_add_cache() 2024-03-06 14:36:10 +00:00
ceph ceph: remove the incorrect Fw reference check when dirtying pages 2024-11-08 16:20:35 +01:00
cifs smb: client: Reset all search buffer pointers when releasing buffer 2025-06-04 14:32:36 +02:00
coda coda: Avoid partial allocation of sig_inputArgs 2023-03-11 16:43:56 +01:00
configfs configfs: Do not override creating attribute file failure in populate_attrs() 2025-06-27 11:02:50 +01:00
cramfs
crypto
debugfs new helper: lookup_positive_unlocked() 2023-09-23 10:59:40 +02:00
devpts
dlm dlm: fix plock lookup when using multiple lockspaces 2023-09-23 10:59:55 +02:00
ecryptfs ecryptfs: Fix buffer size for tag 66 packet 2024-06-16 13:28:32 +02:00
efivarfs efivarfs: Fix error on non-existent file 2025-01-09 13:23:28 +01:00
efs
erofs erofs: fix incorrect symlink detection in fast symlink 2025-01-09 13:23:27 +01:00
exportfs
ext2 ext2: fix datatype of block number in ext2_xattr_set2() 2023-09-23 11:00:04 +02:00
ext4 ext4: fix calculation of credits for extent tree modification 2025-06-27 11:02:51 +01:00
f2fs f2fs: prevent kernel warning due to negative i_nlink from corrupted image 2025-06-27 11:02:51 +01:00
fat fat: fix uninitialized variable 2024-11-08 16:20:47 +01:00
freevxfs
fscache
fuse virtiofs: add filesystem context source name check 2025-05-02 07:39:21 +02:00
gfs2 gfs2: move msleep to sleepable context 2025-06-27 11:02:50 +01:00
hfs hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key 2025-05-02 07:39:20 +02:00
hfsplus hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key 2025-05-02 07:39:20 +02:00
hostfs
hpfs
hugetlbfs fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super 2024-03-06 14:36:10 +00:00
iomap iomap: Set all uptodate bits for an Uptodate page 2024-03-01 13:13:35 +01:00
isofs isofs: Prevent the use of too small fid 2025-05-02 07:39:20 +02:00
jbd2 jbd2: remove wrong sb->s_sequence check 2025-05-02 07:39:15 +02:00
jffs2 jffs2: Fix rtime decompressor 2024-12-14 19:44:56 +01:00
jfs jfs: Fix null-ptr-deref in jfs_ioc_trim 2025-06-27 11:02:54 +01:00
kernfs fs/kernfs/dir: obey S_ISGID 2024-02-23 08:25:03 +01:00
lockd fs: lockd: avoid possible wrong NULL parameter 2023-09-23 10:59:48 +02:00
minix minix: fix bug when opening a file with O_DIRECT 2022-04-15 14:18:35 +02:00
nfs nfs: don't share pNFS DS connections between net namespaces 2025-06-04 14:32:37 +02:00
nfs_common
nfsd nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request 2025-06-27 11:02:51 +01:00
nilfs2 nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() 2025-06-27 11:02:47 +01:00
nls fs/nls: make load_nls() take a const parameter 2023-09-23 10:59:38 +02:00
notify fanotify: disallow mount/sb marks on kernel internal pseudo fs 2023-07-27 08:37:26 +02:00
ntfs ntfs: check overflow when iterating ATTR_RECORDs 2022-11-25 17:42:22 +01:00
ocfs2 ocfs2: stop quota recovery before disabling quotas 2025-06-04 14:32:27 +02:00
omfs treewide: Remove uninitialized_var() usage 2023-06-09 10:29:01 +02:00
openpromfs openpromfs: finish conversion to the new mount API 2024-06-16 13:28:32 +02:00
orangefs orangefs: Do not truncate file size 2025-06-04 14:32:32 +02:00
overlayfs ovl: Filter invalid inodes with missing lookup function 2024-12-14 19:44:43 +01:00
proc fs/procfs: fix the comment above proc_pid_wchan() 2025-04-10 14:29:42 +02:00
pstore pstore/ram: Fix crash when setting number of cpus to an odd number 2024-02-23 08:24:55 +01:00
qnx4
qnx6
quota quota: flush quota_release_work upon quota writeback 2024-12-14 19:44:42 +01:00
ramfs
reiserfs reiserfs: Check the return value from __getblk() 2023-09-23 10:59:40 +02:00
romfs
squashfs Squashfs: check return result of sb_min_blocksize 2025-06-27 11:02:47 +01:00
sysfs fs: sysfs: Fix reference leak in sysfs_break_active_protection() 2024-05-02 16:18:32 +02:00
sysv sysv: don't call sb_bread() with pointers_lock held 2024-04-13 12:51:38 +02:00
tracefs tracefs: Add missing lockdown check to tracefs_create_dir() 2023-09-23 11:00:06 +02:00
ubifs ubifs: skip dumping tnc tree when zroot is null 2025-03-13 12:42:59 +01:00
udf udf: Fix use of check_add_overflow() with mixed type arguments 2025-03-13 12:42:51 +01:00
ufs
unicode Revert "unicode: Don't special case ignorable code points" 2024-12-14 19:44:55 +01:00
verity fsverity: skip PKCS#7 parser when keyring is empty 2023-09-23 10:59:55 +02:00
xfs xfs: don't drop errno values when we fail to ficlone the entire range 2024-12-19 18:05:03 +01:00
aio.c fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion 2024-04-13 12:51:29 +02:00
anon_inodes.c
attr.c attr: block mode changes of symlinks 2023-09-23 11:00:06 +02:00
bad_inode.c
binfmt_aout.c binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf 2023-01-18 11:41:46 +01:00
binfmt_elf.c
binfmt_elf_fdpic.c fs: binfmt_elf_efpic: don't use missing interpreter's properties 2024-09-04 13:14:54 +02:00
binfmt_em86.c
binfmt_flat.c binfmt_flat: Fix integer overflow bug on 32 bit systems 2025-03-13 12:43:07 +01:00
binfmt_misc.c binfmt_misc: cleanup on filesystem umount 2024-09-04 13:14:53 +02:00
binfmt_script.c
block_dev.c block: Don't invalidate pagecache for invalid falloc modes 2024-01-08 11:29:48 +01:00
buffer.c mm: fs: initialize fsdata passed to write_begin/write_end interface 2022-11-25 17:42:22 +01:00
char_dev.c chardev: fix error handling in cdev_device_add() 2023-01-18 11:41:25 +01:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c lsm: new security_file_ioctl_compat() hook 2024-02-23 08:25:15 +01:00
coredump.c coredump: hand a pidfd to the usermode coredump helper 2025-06-04 14:32:36 +02:00
d_path.c
dax.c dax: fix cache flush on PMD-mapped pages 2022-06-14 18:11:41 +02:00
dcache.c fs: better handle deep ancestor chains in is_subdir() 2024-07-27 10:38:32 +02:00
dcookies.c
direct-io.c
drop_caches.c
eventfd.c eventfd: prevent underflow for eventfd semaphores 2023-09-23 10:59:40 +02:00
eventpoll.c epoll: Add synchronous wakeup support for ep_poll_callback 2025-01-09 13:23:32 +01:00
exec.c parisc: Fix stack start for ADDR_NO_RANDOMIZE personality 2024-11-08 16:20:40 +01:00
fcntl.c fs: Fix file_set_fowner LSM hook inconsistencies 2024-11-08 16:20:34 +01:00
fhandle.c do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak 2024-03-26 18:22:13 -04:00
file.c fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE 2024-09-04 13:14:50 +02:00
file_table.c SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() 2022-05-25 09:14:34 +02:00
filesystems.c fs/filesystems: Fix potential unsigned integer underflow in fs_name() 2025-06-27 11:02:50 +01:00
fs-writeback.c writeback: fix call of incorrect macro 2023-05-17 11:35:58 +02:00
fs_context.c fs: avoid empty option when generating legacy mount string 2023-07-27 08:37:25 +02:00
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fsopen.c
inode.c vfs: fix race between evice_inodes() and find_inode()&iput() 2024-11-08 16:20:34 +01:00
internal.h fs: Establish locking order for unrelated directories 2023-07-27 08:37:26 +02:00
io_uring.c io_uring: fail NOP if non-zero op flags is passed in 2024-06-16 13:28:48 +02:00
ioctl.c
Kconfig nfs: add missing selections of CONFIG_CRC32 2025-05-02 07:39:20 +02:00
Kconfig.binfmt
libfs.c libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value 2023-01-18 11:40:55 +01:00
locks.c filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64 2024-09-04 13:15:02 +02:00
Makefile
mbcache.c mbcache: Avoid nesting of cache->c_list_lock under bit locks 2023-01-18 11:41:59 +01:00
mount.h
mpage.c
namei.c fuse: don't truncate cached, mutated symlink 2025-04-10 14:29:36 +02:00
namespace.c do_change_type(): refuse to operate on unmounted/not ours mounts 2025-06-27 11:02:49 +01:00
no-block.c
nsfs.c
open.c ftruncate: pass a signed offset 2024-07-05 09:08:31 +02:00
pipe.c
pnode.c pnode: terminate at peers of source 2023-01-18 11:41:44 +01:00
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c
select.c fs/select: rework stack allocation hack for clang 2024-03-26 18:22:13 -04:00
seq_file.c
signalfd.c io_uring: disable polling pollfree files 2022-09-05 10:27:47 +02:00
splice.c Revert "fs: check FMODE_LSEEK to control internal pipe splicing" 2022-10-17 17:24:32 +02:00
stack.c
stat.c stat: fix inconsistency between struct stat and struct compat_stat 2022-04-27 13:50:48 +02:00
statfs.c statfs: enforce statfs[64] structure initialization 2023-05-30 12:44:07 +01:00
super.c fs: explicitly unregister per-superblock BDIs 2024-11-08 16:20:26 +01:00
sync.c ovl: skip overlayfs superblocks at global sync 2023-12-08 08:44:27 +01:00
timerfd.c
userfaultfd.c userfaultfd: open userfaultfds with O_RDONLY 2022-10-26 13:22:21 +02:00
utimes.c
xattr.c fs: don't audit the capability check in simple_xattr_list() 2023-01-18 11:40:53 +01:00