A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 21:59:12 -04:00
Code Issues Projects Releases Packages Wiki Activity
android_kernel_motorola_sm6375/fs
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Chao Yu 44e904a1ad f2fs: fix to do sanity check on ino and xnid 
[ Upstream commit 061cf3a84bde038708eb0f1d065b31b7c2456533 ]

syzbot reported a f2fs bug as below:

INFO: task syz-executor140:5308 blocked for more than 143 seconds.
      Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor140 state:D stack:24016 pid:5308  tgid:5308  ppid:5306   task_flags:0x400140 flags:0x00000006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0x190e/0x4c90 kernel/sched/core.c:6765
 __schedule_loop kernel/sched/core.c:6842 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6857
 io_schedule+0x8d/0x110 kernel/sched/core.c:7690
 folio_wait_bit_common+0x839/0xee0 mm/filemap.c:1317
 __folio_lock mm/filemap.c:1664 [inline]
 folio_lock include/linux/pagemap.h:1163 [inline]
 __filemap_get_folio+0x147/0xb40 mm/filemap.c:1917
 pagecache_get_page+0x2c/0x130 mm/folio-compat.c:87
 find_get_page_flags include/linux/pagemap.h:842 [inline]
 f2fs_grab_cache_page+0x2b/0x320 fs/f2fs/f2fs.h:2776
 __get_node_page+0x131/0x11b0 fs/f2fs/node.c:1463
 read_xattr_block+0xfb/0x190 fs/f2fs/xattr.c:306
 lookup_all_xattrs fs/f2fs/xattr.c:355 [inline]
 f2fs_getxattr+0x676/0xf70 fs/f2fs/xattr.c:533
 __f2fs_get_acl+0x52/0x870 fs/f2fs/acl.c:179
 f2fs_acl_create fs/f2fs/acl.c:375 [inline]
 f2fs_init_acl+0xd7/0x9b0 fs/f2fs/acl.c:418
 f2fs_init_inode_metadata+0xa0f/0x1050 fs/f2fs/dir.c:539
 f2fs_add_inline_entry+0x448/0x860 fs/f2fs/inline.c:666
 f2fs_add_dentry+0xba/0x1e0 fs/f2fs/dir.c:765
 f2fs_do_add_link+0x28c/0x3a0 fs/f2fs/dir.c:808
 f2fs_add_link fs/f2fs/f2fs.h:3616 [inline]
 f2fs_mknod+0x2e8/0x5b0 fs/f2fs/namei.c:766
 vfs_mknod+0x36d/0x3b0 fs/namei.c:4191
 unix_bind_bsd net/unix/af_unix.c:1286 [inline]
 unix_bind+0x563/0xe30 net/unix/af_unix.c:1379
 __sys_bind_socket net/socket.c:1817 [inline]
 __sys_bind+0x1e4/0x290 net/socket.c:1848
 __do_sys_bind net/socket.c:1853 [inline]
 __se_sys_bind net/socket.c:1851 [inline]
 __x64_sys_bind+0x7a/0x90 net/socket.c:1851
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Let's dump and check metadata of corrupted inode, it shows its xattr_nid
is the same to its i_ino.

dump.f2fs -i 3 chaseyu.img.raw
i_xattr_nid                             [0x       3 : 3]

So that, during mknod in the corrupted directory, it tries to get and
lock inode page twice, result in deadlock.

- f2fs_mknod
 - f2fs_add_inline_entry
  - f2fs_get_inode_page --- lock dir's inode page
   - f2fs_init_acl
    - f2fs_acl_create(dir,..)
     - __f2fs_get_acl
      - f2fs_getxattr
       - lookup_all_xattrs
        - __get_node_page --- try to lock dir's inode page

In order to fix this, let's add sanity check on ino and xnid.

Cc: stable@vger.kernel.org
Reported-by: syzbot+cc448dcdc7ae0b4e4ffa@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-f2fs-devel/67e06150.050a0220.21942d.0005.GAE@google.com
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
[ add set_sbi_flag(sbi, SBI_NEED_FSCK) to match error handling pattern ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:21:33 +02:00
..
9p fs/9p: drop inodes immediately on non-.L too 2024-05-17 11:43:53 +02:00
adfs
affs affs: don't write overlarge OFS data block size fields 2025-04-10 14:29:42 +02:00
afs afs: Fix directory format encoding struct 2025-03-13 12:42:52 +01:00
autofs autofs: fix memory leak of waitqueues in autofs_catatonic_mode 2023-09-23 11:00:02 +02:00
befs
bfs
btrfs btrfs: fix log tree replay failure due to file with 0 links and extents 2025-08-28 16:21:30 +02:00
cachefiles cachefiles: fix memory leak in cachefiles_add_cache() 2024-03-06 14:36:10 +00:00
ceph ceph: fix possible integer overflow in ceph_zero_objects() 2025-07-17 18:24:50 +02:00
cifs cifs: Fix calling CIFSFindFirst() for root path without msearch 2025-08-28 16:21:27 +02:00
coda coda: Avoid partial allocation of sig_inputArgs 2023-03-11 16:43:56 +01:00
configfs configfs: Do not override creating attribute file failure in populate_attrs() 2025-06-27 11:02:50 +01:00
cramfs
crypto
debugfs new helper: lookup_positive_unlocked() 2023-09-23 10:59:40 +02:00
devpts
dlm dlm: fix plock lookup when using multiple lockspaces 2023-09-23 10:59:55 +02:00
ecryptfs ecryptfs: Fix buffer size for tag 66 packet 2024-06-16 13:28:32 +02:00
efivarfs efivarfs: Fix error on non-existent file 2025-01-09 13:23:28 +01:00
efs
erofs erofs: fix incorrect symlink detection in fast symlink 2025-01-09 13:23:27 +01:00
exportfs
ext2 ext2: fix datatype of block number in ext2_xattr_set2() 2023-09-23 11:00:04 +02:00
ext4 ext4: fix reserved gdt blocks handling in fsmap 2025-08-28 16:21:31 +02:00
f2fs f2fs: fix to do sanity check on ino and xnid 2025-08-28 16:21:33 +02:00
fat fat: fix uninitialized variable 2024-11-08 16:20:47 +01:00
freevxfs
fscache
fuse virtiofs: add filesystem context source name check 2025-05-02 07:39:21 +02:00
gfs2 gfs2: move msleep to sleepable context 2025-06-27 11:02:50 +01:00
hfs hfs: fix not erasing deleted b-tree node issue 2025-08-28 16:21:24 +02:00
hfsplus hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() 2025-08-28 16:21:24 +02:00
hostfs
hpfs
hugetlbfs fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super 2024-03-06 14:36:10 +00:00
iomap iomap: Set all uptodate bits for an Uptodate page 2024-03-01 13:13:35 +01:00
isofs isofs: Verify inode mode when loading from disk 2025-08-28 16:21:15 +02:00
jbd2 jbd2: prevent softlockup in jbd2_log_do_checkpoint() 2025-08-28 16:21:31 +02:00
jffs2 jffs2: check jffs2_prealloc_raw_node_refs() result in few other places 2025-06-27 11:02:56 +01:00
jfs jfs: upper bound check of tree index in dbAllocAG 2025-08-28 16:21:28 +02:00
kernfs fs/kernfs/dir: obey S_ISGID 2024-02-23 08:25:03 +01:00
lockd fs: lockd: avoid possible wrong NULL parameter 2023-09-23 10:59:48 +02:00
minix
nfs pNFS: Fix uninited ptr deref in block/scsi layout 2025-08-28 16:21:29 +02:00
nfs_common
nfsd NFSD: detect mismatch of file handle and delegation stateid in OPEN op 2025-08-28 16:21:23 +02:00
nilfs2 nilfs2: reject invalid file types when reading inodes 2025-08-28 16:21:18 +02:00
nls fs/nls: make load_nls() take a const parameter 2023-09-23 10:59:38 +02:00
notify fanotify: disallow mount/sb marks on kernel internal pseudo fs 2023-07-27 08:37:26 +02:00
ntfs
ocfs2 ocfs2: stop quota recovery before disabling quotas 2025-06-04 14:32:27 +02:00
omfs treewide: Remove uninitialized_var() usage 2023-06-09 10:29:01 +02:00
openpromfs openpromfs: finish conversion to the new mount API 2024-06-16 13:28:32 +02:00
orangefs fs/orangefs: use snprintf() instead of sprintf() 2025-08-28 16:21:27 +02:00
overlayfs ovl: Check for NULL d_inode() in ovl_dentry_upper() 2025-07-17 18:24:51 +02:00
proc fix proc_sys_compare() handling of in-lookup dentries 2025-07-17 18:25:01 +02:00
pstore pstore/ram: Fix crash when setting number of cpus to an odd number 2024-02-23 08:24:55 +01:00
qnx4
qnx6
quota quota: flush quota_release_work upon quota writeback 2024-12-14 19:44:42 +01:00
ramfs
reiserfs reiserfs: Check the return value from __getblk() 2023-09-23 10:59:40 +02:00
romfs
squashfs squashfs: fix memory leak in squashfs_fill_super 2025-08-28 16:21:32 +02:00
sysfs fs: sysfs: Fix reference leak in sysfs_break_active_protection() 2024-05-02 16:18:32 +02:00
sysv sysv: don't call sb_bread() with pointers_lock held 2024-04-13 12:51:38 +02:00
tracefs tracefs: Add missing lockdown check to tracefs_create_dir() 2023-09-23 11:00:06 +02:00
ubifs ubifs: skip dumping tnc tree when zroot is null 2025-03-13 12:42:59 +01:00
udf udf: Verify partition map count 2025-08-28 16:21:24 +02:00
ufs
unicode Revert "unicode: Don't special case ignorable code points" 2024-12-14 19:44:55 +01:00
verity fsverity: skip PKCS#7 parser when keyring is empty 2023-09-23 10:59:55 +02:00
xfs xfs: don't drop errno values when we fail to ficlone the entire range 2024-12-19 18:05:03 +01:00
aio.c fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion 2024-04-13 12:51:29 +02:00
anon_inodes.c
attr.c attr: block mode changes of symlinks 2023-09-23 11:00:06 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c
binfmt_elf_fdpic.c fs: binfmt_elf_efpic: don't use missing interpreter's properties 2024-09-04 13:14:54 +02:00
binfmt_em86.c
binfmt_flat.c binfmt_flat: Fix integer overflow bug on 32 bit systems 2025-03-13 12:43:07 +01:00
binfmt_misc.c binfmt_misc: cleanup on filesystem umount 2024-09-04 13:14:53 +02:00
binfmt_script.c
block_dev.c block: Don't invalidate pagecache for invalid falloc modes 2024-01-08 11:29:48 +01:00
buffer.c fs/buffer: fix use-after-free when call bh_read() helper 2025-08-28 16:21:32 +02:00
char_dev.c
compat.c
compat_binfmt_elf.c
compat_ioctl.c lsm: new security_file_ioctl_compat() hook 2024-02-23 08:25:15 +01:00
coredump.c coredump: hand a pidfd to the usermode coredump helper 2025-06-04 14:32:36 +02:00
d_path.c
dax.c
dcache.c fs: better handle deep ancestor chains in is_subdir() 2024-07-27 10:38:32 +02:00
dcookies.c
direct-io.c
drop_caches.c
eventfd.c eventfd: prevent underflow for eventfd semaphores 2023-09-23 10:59:40 +02:00
eventpoll.c epoll: Add synchronous wakeup support for ep_poll_callback 2025-01-09 13:23:32 +01:00
exec.c parisc: Fix stack start for ADDR_NO_RANDOMIZE personality 2024-11-08 16:20:40 +01:00
fcntl.c fs: Fix file_set_fowner LSM hook inconsistencies 2024-11-08 16:20:34 +01:00
fhandle.c do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak 2024-03-26 18:22:13 -04:00
file.c fs: Prevent file descriptor table allocations exceeding INT_MAX 2025-08-28 16:21:23 +02:00
file_table.c
filesystems.c fs/filesystems: Fix potential unsigned integer underflow in fs_name() 2025-06-27 11:02:50 +01:00
fs-writeback.c writeback: fix call of incorrect macro 2023-05-17 11:35:58 +02:00
fs_context.c fs: avoid empty option when generating legacy mount string 2023-07-27 08:37:25 +02:00
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fsopen.c
inode.c vfs: fix race between evice_inodes() and find_inode()&iput() 2024-11-08 16:20:34 +01:00
internal.h fs: Establish locking order for unrelated directories 2023-07-27 08:37:26 +02:00
io_uring.c io_uring: fail NOP if non-zero op flags is passed in 2024-06-16 13:28:48 +02:00
ioctl.c
Kconfig nfs: add missing selections of CONFIG_CRC32 2025-05-02 07:39:20 +02:00
Kconfig.binfmt
libfs.c
locks.c filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64 2024-09-04 13:15:02 +02:00
Makefile
mbcache.c
mount.h
mpage.c
namei.c fuse: don't truncate cached, mutated symlink 2025-04-10 14:29:36 +02:00
namespace.c use uniform permission checks for all mount propagation changes 2025-08-28 16:21:32 +02:00
no-block.c
nsfs.c
open.c ftruncate: pass a signed offset 2024-07-05 09:08:31 +02:00
pipe.c
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c
select.c fs/select: rework stack allocation hack for clang 2024-03-26 18:22:13 -04:00
seq_file.c
signalfd.c
splice.c
stack.c
stat.c
statfs.c statfs: enforce statfs[64] structure initialization 2023-05-30 12:44:07 +01:00
super.c fs: explicitly unregister per-superblock BDIs 2024-11-08 16:20:26 +01:00
sync.c ovl: skip overlayfs superblocks at global sync 2023-12-08 08:44:27 +01:00
timerfd.c
userfaultfd.c
utimes.c
xattr.c