Chao Yu 4dbe38dc38 f2fs: fix to do sanity check with reserved blkaddr of inline inode ... As Wen Xu reported in bugzilla, after image was injected with random data by fuzzing, inline inode would contain invalid reserved blkaddr, then during inline conversion, we will encounter illegal memory accessing reported by KASAN, the root cause of this is when writing out converted inline page, we will use invalid reserved blkaddr to update sit bitmap, result in accessing memory beyond sit bitmap boundary. In order to fix this issue, let's do sanity check with reserved block address of inline inode to avoid above condition. https://bugzilla.kernel.org/show_bug.cgi?id=200179 [ 1428.846352] BUG: KASAN: use-after-free in update_sit_entry+0x80/0x7f0 [ 1428.846618] Read of size 4 at addr ffff880194483540 by task a.out/2741 [ 1428.846855] CPU: 0 PID: 2741 Comm: a.out Tainted: G W 4.17.0+ #1 [ 1428.846858] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 1428.846860] Call Trace: [ 1428.846868] dump_stack+0x71/0xab [ 1428.846875] print_address_description+0x6b/0x290 [ 1428.846881] kasan_report+0x28e/0x390 [ 1428.846888] ? update_sit_entry+0x80/0x7f0 [ 1428.846898] update_sit_entry+0x80/0x7f0 [ 1428.846906] f2fs_allocate_data_block+0x6db/0xc70 [ 1428.846914] ? f2fs_get_node_info+0x14f/0x590 [ 1428.846920] do_write_page+0xc8/0x150 [ 1428.846928] f2fs_outplace_write_data+0xfe/0x210 [ 1428.846935] ? f2fs_do_write_node_page+0x170/0x170 [ 1428.846941] ? radix_tree_tag_clear+0xff/0x130 [ 1428.846946] ? __mod_node_page_state+0x22/0xa0 [ 1428.846951] ? inc_zone_page_state+0x54/0x100 [ 1428.846956] ? __test_set_page_writeback+0x336/0x5d0 [ 1428.846964] f2fs_convert_inline_page+0x407/0x6d0 [ 1428.846971] ? f2fs_read_inline_data+0x3b0/0x3b0 [ 1428.846978] ? __get_node_page+0x335/0x6b0 [ 1428.846987] f2fs_convert_inline_inode+0x41b/0x500 [ 1428.846994] ? f2fs_convert_inline_page+0x6d0/0x6d0 [ 1428.847000] ? kasan_unpoison_shadow+0x31/0x40 [ 1428.847005] ? kasan_kmalloc+0xa6/0xd0 [ 1428.847024] f2fs_file_mmap+0x79/0xc0 [ 1428.847029] mmap_region+0x58b/0x880 [ 1428.847037] ? arch_get_unmapped_area+0x370/0x370 [ 1428.847042] do_mmap+0x55b/0x7a0 [ 1428.847048] vm_mmap_pgoff+0x16f/0x1c0 [ 1428.847055] ? vma_is_stack_for_current+0x50/0x50 [ 1428.847062] ? __fsnotify_update_child_dentry_flags.part.1+0x160/0x160 [ 1428.847068] ? do_sys_open+0x206/0x2a0 [ 1428.847073] ? __fget+0xb4/0x100 [ 1428.847079] ksys_mmap_pgoff+0x278/0x360 [ 1428.847085] ? find_mergeable_anon_vma+0x50/0x50 [ 1428.847091] do_syscall_64+0x73/0x160 [ 1428.847098] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1428.847102] RIP: 0033:0x7fb1430766ba [ 1428.847103] Code: 89 f5 41 54 49 89 fc 55 53 74 35 49 63 e8 48 63 da 4d 89 f9 49 89 e8 4d 63 d6 48 89 da 4c 89 ee 4c 89 e7 b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 56 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00 [ 1428.847162] RSP: 002b:00007ffc651d9388 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1428.847167] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fb1430766ba [ 1428.847170] RDX: 0000000000000001 RSI: 0000000000001000 RDI: 0000000000000000 [ 1428.847173] RBP: 0000000000000003 R08: 0000000000000003 R09: 0000000000000000 [ 1428.847176] R10: 0000000000008002 R11: 0000000000000246 R12: 0000000000000000 [ 1428.847179] R13: 0000000000001000 R14: 0000000000008002 R15: 0000000000000000 [ 1428.847252] Allocated by task 2683: [ 1428.847372] kasan_kmalloc+0xa6/0xd0 [ 1428.847380] kmem_cache_alloc+0xc8/0x1e0 [ 1428.847385] getname_flags+0x73/0x2b0 [ 1428.847390] user_path_at_empty+0x1d/0x40 [ 1428.847395] vfs_statx+0xc1/0x150 [ 1428.847401] __do_sys_newlstat+0x7e/0xd0 [ 1428.847405] do_syscall_64+0x73/0x160 [ 1428.847411] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1428.847466] Freed by task 2683: [ 1428.847566] __kasan_slab_free+0x137/0x190 [ 1428.847571] kmem_cache_free+0x85/0x1e0 [ 1428.847575] filename_lookup+0x191/0x280 [ 1428.847580] vfs_statx+0xc1/0x150 [ 1428.847585] __do_sys_newlstat+0x7e/0xd0 [ 1428.847590] do_syscall_64+0x73/0x160 [ 1428.847596] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1428.847648] The buggy address belongs to the object at ffff880194483300 which belongs to the cache names_cache of size 4096 [ 1428.847946] The buggy address is located 576 bytes inside of 4096-byte region [ffff880194483300, ffff880194484300) [ 1428.848234] The buggy address belongs to the page: [ 1428.848366] page:ffffea0006512000 count:1 mapcount:0 mapping:ffff8801f3586380 index:0x0 compound_mapcount: 0 [ 1428.848606] flags: 0x17fff8000008100(slab|head) [ 1428.848737] raw: 017fff8000008100 dead000000000100 dead000000000200 ffff8801f3586380 [ 1428.848931] raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000 [ 1428.849122] page dumped because: kasan: bad access detected [ 1428.849305] Memory state around the buggy address: [ 1428.849436] ffff880194483400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1428.849620] ffff880194483480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1428.849804] >ffff880194483500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1428.849985] ^ [ 1428.850120] ffff880194483580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1428.850303] ffff880194483600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1428.850498] ================================================================== Reported-by: Wen Xu <wen.xu@gatech.edu> Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>		2018-07-28 18:26:08 -07:00
..
9p	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
adfs	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
affs	affs: fix potential memory leak when parsing option 'prefix'	2018-05-28 12:36:41 +02:00
afs	Merge branch 'afs-proc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-06-16 16:32:04 +09:00
autofs	autofs: rename 'autofs' module back to 'autofs4'	2018-07-05 11:35:04 -07:00
befs	fix a series of Documentation/ broken file name references	2018-06-15 18:10:01 -03:00
bfs	bfs_add_entry: pass name/len as qstr pointer	2018-05-22 14:27:50 -04:00
btrfs	for-4.18-rc2-tag	2018-07-01 12:38:16 -07:00
cachefiles	Merge branch 'hch.procfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-06-04 10:00:01 -07:00
ceph	ceph: fix dentry leak in splice_dentry()	2018-06-26 18:42:44 +02:00
cifs	cifs: Fix invalid check in __cifs_calc_signature()	2018-06-15 19:17:40 -05:00
coda	vfs: change inode times to use struct timespec64	2018-06-05 16:57:31 -07:00
configfs	vfs: change inode times to use struct timespec64	2018-06-05 16:57:31 -07:00
cramfs	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
crypto	f2fs-for-4.18-rc1	2018-06-11 10:16:13 -07:00
debugfs	Revert "debugfs: inode: debugfs_create_dir uses mode permission from parent"	2018-06-12 20:52:16 -07:00
devpts
dlm	treewide: Use array_size() in vmalloc()	2018-06-12 16:19:22 -07:00
ecryptfs	Merge branch 'fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs into aio-base	2018-05-26 09:16:25 +02:00
efivarfs
efs
exofs	exofs: avoid VLA in structures	2018-06-15 07:55:24 +09:00
exportfs	ovl: do not try to reconnect a disconnected origin dentry	2018-04-12 12:04:49 +02:00
ext2	ext2: add warning when specifying nocheck option	2018-06-20 11:04:26 +02:00
ext4	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
f2fs	f2fs: fix to do sanity check with reserved blkaddr of inline inode	2018-07-28 18:26:08 -07:00
fat	Merge branch 'akpm' (patches from Andrew)	2018-06-15 08:51:42 +09:00
freevxfs	freevxfs_lookup(): use d_splice_alias()	2018-05-22 14:27:51 -04:00
fscache	proc: introduce proc_create_single{,_data}	2018-05-16 07:23:35 +02:00
fuse	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
gfs2	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
hfs	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
hfsplus	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
hostfs	vfs: change inode times to use struct timespec64	2018-06-05 16:57:31 -07:00
hpfs	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
hugetlbfs	hugetlbfs: fix bug in pgoff overflow checking	2018-04-05 21:36:21 -07:00
isofs	isofs: fix potential memory leak in mount option parsing	2018-04-16 09:47:41 +02:00
jbd2	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
jffs2	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
jfs	This fixes a too-small allocation in the xattr code.	2018-06-19 07:47:32 +09:00
kernfs	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
lockd
minix	minix_lookup: use d_splice_alias()	2018-05-22 14:27:52 -04:00
nfs	NFS client bugfixes for Linux 4.18	2018-06-22 06:21:34 +09:00
nfs_common
nfsd	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
nilfs2	do d_instantiate/unlock_new_inode combinations safely	2018-05-11 15:36:37 -04:00
nls
notify	fsnotify: add fsnotify_add_inode_mark() wrappers	2018-05-18 14:58:22 +02:00
ntfs	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
ocfs2	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
omfs	omfs_lookup(): report IO errors, use d_splice_alias()	2018-05-22 14:27:58 -04:00
openpromfs	openpromfs: switch to d_splice_alias()	2018-05-22 14:27:57 -04:00
orangefs	Solve a series of broken links for files under Documentation:	2018-06-17 05:25:18 +09:00
overlayfs	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
proc	Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-07-01 12:32:19 -07:00
pstore	pstore: Remove bogus format string definition	2018-06-14 14:57:24 +02:00
qnx4	qnx4_lookup: use d_splice_alias()	2018-05-22 14:27:52 -04:00
qnx6	qnx6_lookup: switch to d_splice_alias()	2018-05-22 14:27:54 -04:00
quota	quota: Cleanup list iteration in dqcache_shrink_scan()	2018-06-20 11:04:26 +02:00
ramfs
reiserfs	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
romfs	romfs_lookup: switch to d_splice_alias()	2018-05-22 14:27:55 -04:00
squashfs
sysfs	unfuck sysfs_mount()	2018-05-21 14:30:09 -04:00
sysv	sysv_lookup: use d_splice_alias()	2018-05-22 14:27:53 -04:00
tracefs
ubifs	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
udf	udf: Drop unused arguments of udf_delete_aext()	2018-06-20 11:05:49 +02:00
ufs	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
xfs	xfs: fix fdblocks accounting w/ RMAPBT per-AG reservation	2018-06-24 12:00:12 -07:00
aio.c	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
anon_inodes.c
attr.c	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
bad_inode.c	vfs: change inode times to use struct timespec64	2018-06-05 16:57:31 -07:00
binfmt_aout.c	exec: introduce finalize_exec() before start_thread()	2018-04-11 10:28:37 -07:00
binfmt_elf_fdpic.c	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
binfmt_elf.c	coredump: fix spam with zero VMA process	2018-06-15 07:55:24 +09:00
binfmt_em86.c
binfmt_flat.c	exec: introduce finalize_exec() before start_thread()	2018-04-11 10:28:37 -07:00
binfmt_misc.c	docs: Fix more broken references	2018-06-15 18:11:26 -03:00
binfmt_script.c
block_dev.c	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
buffer.c	fs: move page_cache_seek_hole_data to iomap.c	2018-06-01 18:37:33 -07:00
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c	autofs: clean up includes	2018-06-07 17:34:40 -07:00
compat.c	ncpfs: remove compat functionality	2018-06-05 19:23:26 +02:00
coredump.c
d_path.c
dax.c	libnvdimm for 4.18	2018-06-08 17:21:52 -07:00
dcache.c	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-06-04 10:14:28 -07:00
dcookies.c
direct-io.c	block: consistently use GFP_NOIO instead of __GFP_NORECLAIM	2018-05-14 08:55:18 -06:00
drop_caches.c
eventfd.c	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
eventpoll.c	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
exec.c	Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-06-10 10:17:09 -07:00
fcntl.c	mm: restructure memfd code	2018-06-07 17:34:35 -07:00
fhandle.c
file_table.c
file.c
filesystems.c	proc: introduce proc_create_single{,_data}	2018-05-16 07:23:35 +02:00
fs_pin.c
fs_struct.c
fs-writeback.c	bdi: Fix oops in wb_workfn()	2018-05-03 16:11:37 -06:00
inode.c	Fix up non-directory creation in SGID directories	2018-07-05 12:36:36 -07:00
internal.h	Revert "fs: fold open_check_o_direct into do_dentry_open"	2018-06-03 10:58:23 -07:00
ioctl.c	fs: Allow CAP_SYS_ADMIN in s_user_ns to freeze and thaw filesystems	2018-05-24 12:04:28 -05:00
iomap.c	Changes since last update:	2018-06-12 15:49:00 -07:00
Kconfig	autofs: remove left-over autofs4 stubs	2018-06-11 08:22:34 -07:00
Kconfig.binfmt	docs: Fix more broken references	2018-06-15 18:11:26 -03:00
libfs.c
locks.c	vfs/y2038: inode timestamps conversion to timespec64	2018-06-15 07:31:07 +09:00
Makefile	autofs: remove left-over autofs4 stubs	2018-06-11 08:22:34 -07:00
mbcache.c	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
mount.h
mpage.c
namei.c	Merge branch 'afs-proc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-06-16 16:32:04 +09:00
namespace.c	fs: Allow superblock owner to access do_remount_sb()	2018-05-24 12:02:25 -05:00
no-block.c
nsfs.c
open.c	Revert "fs: fold open_check_o_direct into do_dentry_open"	2018-06-03 10:58:23 -07:00
pipe.c	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
readdir.c
select.c	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
seq_file.c	proc: fix smaps and meminfo alignment	2018-05-25 18:12:11 -07:00
signalfd.c	Merge branch 'work.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-06-16 16:21:50 +09:00
splice.c	Merge branch 'work.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-06-16 16:21:50 +09:00
stack.c
stat.c
statfs.c
super.c	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-06-04 10:14:28 -07:00
sync.c	Changes for this release:	2018-04-04 12:44:02 -07:00
timerfd.c	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
userfaultfd.c	userfaultfd: hugetlbfs: fix userfaultfd_huge_must_wait() pte access	2018-07-03 17:32:18 -07:00
utimes.c
xattr.c	vfs: delete unnecessary assignment in vfs_listxattr	2018-05-29 13:22:41 -04:00