No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Chao Yu b0406b5ef4 f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
commit 5598b24efaf4892741c798b425d543e4bed357a1 upstream.

As Wenqing Liu reported in bugzilla:

https://bugzilla.kernel.org/show_bug.cgi?id=215235

- Overview
page fault in f2fs_setxattr() when mount and operate on corrupted image

- Reproduce
tested on kernel 5.16-rc3, 5.15.X under root

1. unzip tmp7.zip
2. ./single.sh f2fs 7

Sometimes need to run the script several times

- Kernel dump
loop0: detected capacity change from 0 to 131072
F2FS-fs (loop0): Found nat_bits in checkpoint
F2FS-fs (loop0): Mounted with checkpoint version = 7548c2ee
BUG: unable to handle page fault for address: ffffe47bc7123f48
RIP: 0010:kfree+0x66/0x320
Call Trace:
 __f2fs_setxattr+0x2aa/0xc00 [f2fs]
 f2fs_setxattr+0xfa/0x480 [f2fs]
 __f2fs_set_acl+0x19b/0x330 [f2fs]
 __vfs_removexattr+0x52/0x70
 __vfs_removexattr_locked+0xb1/0x140
 vfs_removexattr+0x56/0x100
 removexattr+0x57/0x80
 path_removexattr+0xa3/0xc0
 __x64_sys_removexattr+0x17/0x20
 do_syscall_64+0x37/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The root cause is in __f2fs_setxattr(), we missed to do sanity check on
last xattr entry, result in out-of-bound memory access during updating
inconsistent xattr data of target inode.

After the fix, it can detect such xattr inconsistency as below:

F2FS-fs (loop11): inode (7) has invalid last xattr entry, entry_size: 60676
F2FS-fs (loop11): inode (8) has corrupted xattr
F2FS-fs (loop11): inode (8) has corrupted xattr
F2FS-fs (loop11): inode (8) has invalid last xattr entry, entry_size: 47736

Cc: stable@vger.kernel.org
Reported-by: Wenqing Liu <wenqingliu0120@gmail.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-12-29 12:23:37 +01:00
arch ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling 2021-12-29 12:23:37 +01:00
block block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) 2021-12-14 14:49:02 +01:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:47:29 +02:00
crypto crypto: pcrypt - Delay write to padata->info 2021-11-17 09:48:40 +01:00
Documentation hwmon: (lm90) Add basic support for TI TMP461 2021-12-29 12:23:35 +01:00
drivers tee: optee: Fix incorrect page free bug 2021-12-29 12:23:37 +01:00
fs f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() 2021-12-29 12:23:37 +01:00
include net: skip virtio_net_hdr_set_proto if protocol already set 2021-12-29 12:23:34 +01:00
init
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-01 09:23:35 +01:00
kernel rcu: Mark accesses to rcu_state.n_force_qs 2021-12-22 09:29:40 +01:00
lib siphash: use _unaligned version by default 2021-12-08 09:01:12 +01:00
LICENSES
mm memblock: ensure there is no overflow in memblock_overlaps_region() 2021-12-17 10:12:24 +01:00
net netfilter: fix regression in looped (broad|multi)cast's MAC handling 2021-12-29 12:23:34 +01:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-17 09:48:39 +01:00
scripts recordmcount.pl: look for jgnop instruction as well as bcrl on s390 2021-12-22 09:29:35 +01:00
security selinux: fix race condition when computing ocontext SIDs 2021-12-17 10:12:24 +01:00
sound ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6 2021-12-29 12:23:36 +01:00
tools selftest/net/forwarding: declare NETIFS p9 p10 2021-12-22 09:29:36 +01:00
usr
virt KVM: do not shrink halt_poll_ns below grow_start 2021-10-09 14:39:50 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.168 2021-12-22 09:29:41 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.