Carlos Maiolino
dce30ca9e3
fs: fix guard_bio_eod to check for real EOD errors ...
guard_bio_eod() can truncate a segment in bio to allow it to do IO on
odd last sectors of a device.
It already checks if the IO starts past EOD, but it does not consider
the possibility of an IO request starting within device boundaries can
contain more than one segment past EOD.
In such cases, truncated_bytes can be bigger than PAGE_SIZE, and will
underflow bvec->bv_len.
Fix this by checking if truncated_bytes is lower than PAGE_SIZE.
This situation has been found on filesystems such as isofs and vfat,
which doesn't check the device size before mount, if the device is
smaller than the filesystem itself, a readahead on such filesystem,
which spans EOD, can trigger this situation, leading a call to
zero_user() with a wrong size possibly corrupting memory.
I didn't see any crash, or didn't let the system run long enough to
check if memory corruption will be hit somewhere, but adding
instrumentation to guard_bio_end() to check truncated_bytes size, was
enough to see the error.
The following script can trigger the error.
MNT=/mnt
IMG=./DISK.img
DEV=/dev/loop0
mkfs.vfat $IMG
mount $IMG $MNT
cp -R /etc $MNT &> /dev/null
umount $MNT
losetup -D
losetup --find --show --sizelimit 16247280 $IMG
mount $DEV $MNT
find $MNT -type f -exec cat {} + >/dev/null
Kudos to Eric Sandeen for coming up with the reproducer above
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2019-02-28 13:59:41 -07:00
Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-11-01 19:58:52 -07:00
adfs: use timespec64 for time conversion
2018-08-22 10:52:51 -07:00
afs: Fix race in async call refcounting
2019-01-17 15:17:28 +00:00
autofs: fix error return in autofs_fill_super()
2019-02-01 15:46:24 -08:00
bfs: extra sanity checking and static inode bitmap
2019-01-04 13:13:47 -08:00
Linux 5.0-rc6
2019-02-15 08:43:59 -07:00
fscache, cachefiles: remove redundant variable 'cache'
2018-11-30 16:00:58 +00:00
ceph: quota: cleanup license mess
2019-01-21 14:53:23 +01:00
cifs: update internal module version number
2019-01-31 07:05:06 -06:00
Make the Cramfs code more robust against filesystem corruptions,
2018-10-30 12:46:25 -07:00
block: allow bio_for_each_segment_all() to iterate over multi-page bvec
2019-02-15 08:40:11 -07:00
debugfs: debugfs_lookup() should return NULL if not found
2019-01-30 12:39:49 +01:00
devpts: Convert to new IDA API
2018-08-21 23:54:17 -04:00
dlm: fix invalid cluster name warning
2018-12-03 15:30:24 -06:00
ecryptfs_rename(): verify that lower dentries are still OK after lock_rename()
2018-10-09 23:33:17 -04:00
block: allow bio_for_each_segment_all() to iterate over multi-page bvec
2019-02-15 08:40:11 -07:00
exportfs: do not read dentry after free
2018-11-23 09:08:17 -05:00
\n
2018-12-27 17:00:35 -08:00
block: allow bio_for_each_segment_all() to iterate over multi-page bvec
2019-02-15 08:40:11 -07:00
block: allow bio_for_each_segment_all() to iterate over multi-page bvec
2019-02-15 08:40:11 -07:00
Merge branch 'akpm' (patches from Andrew)
2019-01-05 09:16:18 -08:00
fscache: fix race between enablement and dropping of object
2018-11-30 15:57:31 +00:00
fuse: decrement NR_WRITEBACK_TEMP on the right page
2019-01-16 10:27:59 +01:00
iomap: wire up the iopoll method
2019-02-24 08:20:17 -07:00
hfs: do not free node before using
2018-11-30 14:56:14 -08:00
hfsplus: return file attributes on statx
2019-01-04 13:13:47 -08:00
vfs: discard ATTR_ATTR_FLAG
2018-08-17 16:20:28 -07:00
hpfs: remove unnecessary checks on the value of r when assigning error code
2018-08-25 12:42:33 -07:00
hugetlbfs: revert "Use i_mmap_rwsem to fix page fault/truncate race"
2019-01-08 17:15:11 -08:00
Update email address
2018-09-29 22:47:48 -04:00
jbd2: clean up indentation issue, replace spaces with tab
2018-12-04 00:20:10 -05:00
jffs2: Fix use of uninitialized delayed_work, lockdep breakage
2018-12-02 09:20:34 +01:00
jfs: remove redundant dquot_initialize() in jfs_evict_inode()
2018-09-20 09:28:49 -05:00
kernfs: Improve kernfs_notify() poll notification latency
2018-11-27 11:59:33 +01:00
NFS client updates for Linux 4.21
2019-01-02 16:35:23 -08:00
NFS: Fix up return value on fatal errors in nfs_page_async_flush()
2019-01-29 16:33:24 -05:00
nfsd: Fix error return values for nfsd4_clone_file_range()
2019-02-06 15:32:05 -05:00
nilfs2: Use xa_erase_irq
2018-11-05 14:57:05 -05:00
inotify: Fix fd refcount leak in inotify_add_watch().
2019-01-02 18:28:37 +01:00
mm: convert totalram_pages and totalhigh_pages variables to atomic
2018-12-28 12:11:47 -08:00
Merge branch 'akpm' (patches from Andrew)
2019-01-05 09:16:18 -08:00
fs/openpromfs: Use of_node_name_eq for node name comparisons
2018-11-18 13:35:19 -08:00
fs: don't open code lru_to_page()
2019-01-04 13:13:48 -08:00
Revert "ovl: relax permission checking on underlying layers"
2018-12-04 11:31:30 +01:00
proc: fix /proc/net/* after setns(2)
2019-02-01 15:46:22 -08:00
pstore/ram: Avoid allocation and leak of platform data
2019-01-20 14:44:52 -08:00
quota: Lock s_umount in exclusive mode for Q_XQUOTA{ON,OFF} quotactls.
2018-12-18 18:29:15 +01:00
reiserfs: remove workaround code for GCC 3.x
2018-10-31 08:54:14 -07:00
sysfs: convert BUG_ON to WARN_ON
2019-01-07 08:53:32 +01:00
sysv: return 'err' instead of 0 in __sysv_write_inode
2018-11-10 08:02:40 -05:00
mm: migrate: drop unused argument of migrate_page_move_mapping()
2018-12-28 12:11:51 -08:00
\n
2018-12-27 17:00:35 -08:00
fs/ufs: use ktime_get_real_seconds for sb and cg timestamps
2018-08-17 16:20:27 -07:00
iomap: wire up the iopoll method
2019-02-24 08:20:17 -07:00
aio: initialize kiocb private in case any filesystems expect it.
2019-02-06 08:04:22 -07:00
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
signal: Distinguish between kernel_siginfo and siginfo
2018-10-03 16:47:43 +02:00
exec: load_script: don't blindly truncate shebang string
2019-01-04 13:13:47 -08:00
block: add bio_set_polled() helper
2019-02-24 08:20:17 -07:00
fs: fix guard_bio_eod to check for real EOD errors
2019-02-28 13:59:41 -07:00
y2038: globally rename compat_time to old_time32
2018-08-27 14:48:48 +02:00
media updates for v4.20-rc1
2018-10-29 14:29:58 -07:00
signal: Distinguish between kernel_siginfo and siginfo
2018-10-03 16:47:43 +02:00
dax fix 4.21
2018-12-31 09:46:39 -08:00
fs/dcache: Track & report number of negative dentries
2019-01-30 11:02:11 -08:00
block: allow bio_for_each_segment_all() to iterate over multi-page bvec
2019-02-15 08:40:11 -07:00
fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
2019-02-01 15:46:24 -08:00
Merge branch 'akpm' (patches from Andrew)
2019-01-05 09:16:18 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-01-05 13:18:59 -08:00
signal: Distinguish between kernel_siginfo and siginfo
2018-10-03 16:47:43 +02:00
Char/Misc driver patches for 4.21-rc1
2018-12-28 20:54:57 -08:00
mm: convert totalram_pages and totalhigh_pages variables to atomic
2018-12-28 12:11:47 -08:00
writeback: synchronize sync(2) against cgroup writeback membership switches
2019-01-22 14:39:38 -07:00
y2038: more syscalls and cleanups
2018-12-28 12:45:04 -08:00
overlayfs update for 4.19
2018-08-21 18:19:09 -07:00
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
iomap: wire up the iopoll method
2019-02-24 08:20:17 -07:00
locks: fix error in locks_move_blocks()
2019-01-02 20:14:50 -05:00
block: allow bio_for_each_segment_all() to iterate over multi-page bvec
2019-02-15 08:40:11 -07:00
Revert "vfs: Allow userns root to call mknod on owned filesystems."
2018-12-22 14:18:34 -08:00
Merge branch 'mount.part1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-01-05 13:25:58 -08:00
overlayfs update for 4.19
2018-08-21 18:19:09 -07:00
Merge branch 'work.open3' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-08-13 19:58:36 -07:00
vfs: Suppress MS_* flag defs within the kernel unless explicitly enabled
2018-12-20 16:32:56 +00:00
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
fs/seq_file.c: simplify seq_file iteration code and interface
2018-08-17 16:20:28 -07:00
signal: Distinguish between kernel_siginfo and siginfo
2018-10-03 16:47:43 +02:00
splice: don't read more than available pipe space
2018-12-04 08:50:49 -08:00
y2038: Remove newstat family from default syscall set
2018-08-29 15:42:20 +02:00
mount_fs: suppress MAC on MS_SUBMOUNT as well as MS_KERNMOUNT
2018-12-21 11:51:23 -05:00
y2038: globally rename compat_time to old_time32
2018-08-27 14:48:48 +02:00
userfaultfd: clear flag if remap event not enabled
2018-12-28 12:11:51 -08:00
y2038: utimes: Rework #ifdef guards for compat syscalls
2018-08-29 15:42:23 +02:00
sysfs: Do not return POSIX ACL xattrs via listxattr
2018-09-18 07:30:48 -04:00
dce30ca9e3