microsoft
/
WSL2-Linux-Kernel
зеркало из https://github.com/microsoft/WSL2-Linux-Kernel.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
WSL2-Linux-Kernel/fs
История
Ye Bin 0a43c015e9 ext4: fix warning in 'ext4_da_release_space' 
commit 1b8f787ef5 upstream.

Syzkaller report issue as follows:
EXT4-fs (loop0): Free/Dirty block details
EXT4-fs (loop0): free_blocks=0
EXT4-fs (loop0): dirty_blocks=0
EXT4-fs (loop0): Block reservation details
EXT4-fs (loop0): i_reserved_data_blocks=0
EXT4-fs warning (device loop0): ext4_da_release_space:1527: ext4_da_release_space: ino 18, to_free 1 with only 0 reserved data blocks
------------[ cut here ]------------
WARNING: CPU: 0 PID: 92 at fs/ext4/inode.c:1528 ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1524
Modules linked in:
CPU: 0 PID: 92 Comm: kworker/u4:4 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Workqueue: writeback wb_workfn (flush-7:0)
RIP: 0010:ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1528
RSP: 0018:ffffc900015f6c90 EFLAGS: 00010296
RAX: 42215896cd52ea00 RBX: 0000000000000000 RCX: 42215896cd52ea00
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
RBP: 1ffff1100e907d96 R08: ffffffff816aa79d R09: fffff520002bece5
R10: fffff520002bece5 R11: 1ffff920002bece4 R12: ffff888021fd2000
R13: ffff88807483ecb0 R14: 0000000000000001 R15: ffff88807483e740
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555569ba628 CR3: 000000000c88e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ext4_es_remove_extent+0x1ab/0x260 fs/ext4/extents_status.c:1461
 mpage_release_unused_pages+0x24d/0xef0 fs/ext4/inode.c:1589
 ext4_writepages+0x12eb/0x3be0 fs/ext4/inode.c:2852
 do_writepages+0x3c3/0x680 mm/page-writeback.c:2469
 __writeback_single_inode+0xd1/0x670 fs/fs-writeback.c:1587
 writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1870
 wb_writeback+0x41f/0x7b0 fs/fs-writeback.c:2044
 wb_do_writeback fs/fs-writeback.c:2187 [inline]
 wb_workfn+0x3cb/0xef0 fs/fs-writeback.c:2227
 process_one_work+0x877/0xdb0 kernel/workqueue.c:2289
 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>

Above issue may happens as follows:
ext4_da_write_begin
  ext4_create_inline_data
    ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
    ext4_set_inode_flag(inode, EXT4_INODE_INLINE_DATA);
__ext4_ioctl
  ext4_ext_migrate -> will lead to eh->eh_entries not zero, and set extent flag
ext4_da_write_begin
  ext4_da_convert_inline_data_to_extent
    ext4_da_write_inline_data_begin
      ext4_da_map_blocks
        ext4_insert_delayed_block
	  if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk))
	    if (!ext4_es_scan_clu(inode, &ext4_es_is_mapped, lblk))
	      ext4_clu_mapped(inode, EXT4_B2C(sbi, lblk)); -> will return 1
	       allocated = true;
          ext4_es_insert_delayed_block(inode, lblk, allocated);
ext4_writepages
  mpage_map_and_submit_extent(handle, &mpd, &give_up_on_write); -> return -ENOSPC
  mpage_release_unused_pages(&mpd, give_up_on_write); -> give_up_on_write == 1
    ext4_es_remove_extent
      ext4_da_release_space(inode, reserved);
        if (unlikely(to_free > ei->i_reserved_data_blocks))
	  -> to_free == 1  but ei->i_reserved_data_blocks == 0
	  -> then trigger warning as above

To solve above issue, forbid inode do migrate which has inline data.

Cc: stable@kernel.org
Reported-by: syzbot+c740bb18df70ad00952e@syzkaller.appspotmail.com
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20221018022701.683489-1-yebin10@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2022-11-10 18:15:40 +01:00
..
9p 9p: fix a bunch of checkpatch warnings 2022-08-17 14:24:07 +02:00
adfs
…
affs
…
afs afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked 2022-09-23 14:15:51 +02:00
autofs autofs: fix wait name hash calculation in autofs_wait() 2021-10-20 21:09:02 -04:00
befs
…
bfs
…
btrfs btrfs: fix type of parameter generation in btrfs_get_dentry 2022-11-10 18:15:38 +01:00
cachefiles fs: add is_idmapped_mnt() helper 2022-07-02 16:41:14 +02:00
ceph ceph: don't truncate file in atomic_open 2022-10-15 07:59:01 +02:00
cifs cifs: Fix xid leak in cifs_ses_add_channel() 2022-10-29 10:12:56 +02:00
coda
…
configfs configfs: fix a race in configfs_{,un}register_subsystem() 2022-03-02 11:48:02 +01:00
cramfs
…
crypto fscrypt: fix keyring memory leak on mount failure 2022-11-10 18:15:37 +01:00
debugfs debugfs: add debugfs_lookup_and_remove() 2022-09-15 11:30:02 +02:00
devpts fsnotify: fix fsnotify hooks in pseudo filesystems 2022-02-01 17:27:01 +01:00
dlm fs: dlm: fix invalid derefence of sb_lvbptr 2022-10-29 10:12:57 +02:00
ecryptfs fs: add is_idmapped_mnt() helper 2022-07-02 16:41:14 +02:00
efivarfs
…
efs
…
erofs erofs: fix pcluster use-after-free on UP platforms 2022-09-15 11:30:06 +02:00
exfat exfat: use updated exfat_chain directly during renaming 2022-07-29 17:25:30 +02:00
exportfs exportfs: support idmapped mounts 2022-06-09 10:23:32 +02:00
ext2 ext2: Use kvmalloc() for group descriptor array 2022-10-26 12:35:51 +02:00
ext4 ext4: fix warning in 'ext4_da_release_space' 2022-11-10 18:15:40 +01:00
f2fs f2fs: fix to account FS_CP_DATA_IO correctly 2022-10-26 12:35:28 +02:00
fat fat: add ratelimit to fat*_ent_bread() 2022-06-09 10:22:42 +02:00
freevxfs
…
fscache fscache: Remove an unused static variable 2021-10-04 22:13:12 +01:00
fuse fuse: add file_modified() to fallocate 2022-11-10 18:15:39 +01:00
gfs2 gfs2: Fix gfs2_file_buffered_write endless loop workaround 2022-07-12 16:34:59 +02:00
hfs
…
hfsplus
…
hostfs
…
hpfs
…
hugetlbfs hugetlbfs: fix hugetlbfs_statfs() locking 2022-06-09 10:23:11 +02:00
iomap iomap: iomap_write_failed fix 2022-06-09 10:22:55 +02:00
isofs isofs: Fix out of bound access for corrupted isofs image 2021-11-12 15:05:50 +01:00
jbd2 jbd2: add miss release buffer head in fc_do_one_pass() 2022-10-26 12:34:28 +02:00
jffs2 jffs2: fix memory leak in jffs2_do_fill_super 2022-06-14 18:36:10 +02:00
jfs fs: jfs: fix possible NULL pointer dereference in dbFree() 2022-06-09 10:22:41 +02:00
kernfs kernfs: fix use-after-free in __kernfs_remove 2022-11-03 23:59:13 +09:00
ksmbd ksmbd: fix incorrect handling of iterate_dir 2022-10-29 10:12:57 +02:00
lockd lockd: detect and reject lock arguments that overflow 2022-08-17 14:22:47 +02:00
minix minix: fix bug when opening a file with O_DIRECT 2022-04-13 20:59:10 +02:00
netfs netfs: fix parameter of cleanup() 2021-12-29 12:28:59 +01:00
nfs nfs4: Fix kmemleak when allocate slot failed 2022-11-10 18:15:26 +01:00
nfs_common nfs: Fix kerneldoc warning shown up by W=1 2021-10-04 22:02:17 +01:00
nfsd NFSD: fix use-after-free on source server when doing inter-server copy 2022-10-26 12:35:32 +02:00
nilfs2 nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure 2022-10-15 07:59:01 +02:00
nls
…
notify fsnotify: fix wrong lockdep annotations 2022-06-09 10:22:50 +02:00
ntfs ntfs: fix BUG_ON in ntfs_lookup_inode_by_name() 2022-10-05 10:39:37 +02:00
ntfs3 ntfs3: rework xattr handlers and switch to POSIX ACL VFS helpers 2022-10-26 12:34:36 +02:00
ocfs2 ocfs2: fix BUG when iput after ocfs2_mknod fails 2022-10-29 10:12:53 +02:00
omfs
…
openpromfs
…
orangefs orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() 2022-01-20 09:13:13 +01:00
overlayfs ovl: warn if trusted xattr creation fails 2022-08-25 11:40:43 +02:00
proc mm: /proc/pid/smaps_rollup: fix no vma's null-deref 2022-10-29 10:12:58 +02:00
pstore pstore: Don't use semaphores in always-atomic-context code 2022-04-08 14:23:01 +02:00
qnx4
…
qnx6
…
quota quota: Check next/prev free block number after reading from quota file 2022-10-26 12:34:21 +02:00
ramfs
…
reiserfs
…
romfs
…
smbfs_common cifs: Fix crash on unload of cifs_arc4.ko 2021-12-14 10:57:12 +01:00
squashfs
…
sysfs
…
sysv
…
tracefs tracefs: Only clobber mode/uid/gid on remount if asked 2022-09-20 12:39:43 +02:00
ubifs ubifs: rename_whiteout: correct old_dir size computing 2022-04-08 14:24:08 +02:00
udf udf: Avoid using stale lengthOfImpUse 2022-05-15 20:18:52 +02:00
ufs
…
unicode
…
vboxsf vboxfs: fix broken legacy mount signature checking 2021-09-27 11:26:21 -07:00
verity
…
xfs fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE 2022-10-26 12:34:27 +02:00
zonefs block: add a bdev_max_zone_append_sectors helper 2022-08-31 17:16:34 +02:00
Kconfig
…
Kconfig.binfmt
…
Makefile
…
aio.c aio: Fix incorrect usage of eventfd_signal_allowed() 2021-12-14 10:57:22 +01:00
anon_inodes.c
…
attr.c vfs: Check the truncate maximum size in inode_newsize_ok() 2022-08-17 14:22:50 +02:00
bad_inode.c
…
binfmt_aout.c
…
binfmt_elf.c fs/binfmt_elf: Fix memory leak in load_elf_binary() 2022-11-03 23:59:12 +09:00
binfmt_elf_fdpic.c coredump: Snapshot the vmas in do_coredump 2022-04-08 14:24:17 +02:00
binfmt_flat.c binfmt_flat: do not stop relocating GOT entries prematurely on riscv 2022-06-09 10:22:26 +02:00
binfmt_misc.c
…
binfmt_script.c
…
buffer.c mm: fs: fix lru_cache_disabled race in bh_lru 2022-04-08 14:22:54 +02:00
char_dev.c
…
compat_binfmt_elf.c
…
coredump.c coredump: Use the vma snapshot in fill_files_note 2022-04-08 14:24:18 +02:00
d_path.c
…
dax.c fsdax: Fix infinite loop in dax_iomap_rw() 2022-09-28 11:11:56 +02:00
dcache.c
…
direct-io.c
…
drop_caches.c
…
eventfd.c eventfd: guard wake_up in eventfd fs calls as well 2022-10-26 12:35:49 +02:00
eventpoll.c epoll: autoremove wakers even more aggressively 2022-08-17 14:22:59 +02:00
exec.c exec: Copy oldsighand->action under spin-lock 2022-11-03 23:59:12 +09:00
fcntl.c
…
fhandle.c
…
file.c fs: fix fd table size alignment properly 2022-04-08 14:23:54 +02:00
file_table.c locks: fix TOCTOU race when granting write lease 2022-10-26 12:34:58 +02:00
filesystems.c
…
fs-writeback.c fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE 2022-10-26 12:34:27 +02:00
fs_context.c vfs: fs_context: fix up param length parsing in legacy_parse_param 2022-01-20 09:13:14 +01:00
fs_parser.c
…
fs_pin.c
…
fs_struct.c
…
fs_types.c
…
fsopen.c
…
init.c
…
inode.c fs: fix UAF/GPF bug in nilfs_mdt_destroy 2022-10-12 09:53:26 +02:00
internal.h locks: fix TOCTOU race when granting write lease 2022-10-26 12:34:58 +02:00
io-wq.c io-wq: Fix memory leak in worker creation 2022-10-26 12:35:56 +02:00
io-wq.h
…
io_uring.c io_uring/rw: fix unexpected link breakage 2022-10-26 12:35:53 +02:00
ioctl.c fs: fix an infinite loop in iomap_fiemap 2022-05-25 09:57:26 +02:00
kernel_read_file.c vfs: check fd has read access in kernel_read_file_from_fd() 2021-10-18 20:22:03 -10:00
libfs.c
…
locks.c
…
mbcache.c mbcache: add functions to delete entry if unused 2022-08-17 14:22:57 +02:00
mount.h
…
mpage.c
…
namei.c __follow_mount_rcu(): verify that mount_lock remains unchanged 2022-08-17 14:24:19 +02:00
namespace.c fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts 2022-08-31 17:16:37 +02:00
no-block.c
…
nsfs.c
…
open.c locks: fix TOCTOU race when granting write lease 2022-10-26 12:34:58 +02:00
pipe.c pipe: Fix missing lock in pipe_resize_ring() 2022-06-06 08:43:37 +02:00
pnode.c
…
pnode.h
…
posix_acl.c fs: fix acl translation 2022-07-02 16:41:17 +02:00
proc_namespace.c fs: add is_idmapped_mnt() helper 2022-07-02 16:41:14 +02:00
read_write.c fs: sendfile handles O_NONBLOCK of out_fd 2022-08-03 12:03:41 +02:00
readdir.c
…
remap_range.c fs/remap: constrain dedupe of EOF blocks 2022-07-21 21:24:14 +02:00
select.c select: Fix indefinitely sleeping task in poll_schedule_timeout() 2022-01-29 10:58:25 +01:00
seq_file.c rxrpc: Fix locking issue 2022-07-12 16:35:08 +02:00
signalfd.c signalfd: use wake_up_pollfree() 2021-12-14 10:57:15 +01:00
splice.c Revert "fs: check FMODE_LSEEK to control internal pipe splicing" 2022-10-26 12:34:17 +02:00
stack.c
…
stat.c stat: fix inconsistency between struct stat and struct compat_stat 2022-04-27 14:38:57 +02:00
statfs.c
…
super.c fscrypt: fix keyring memory leak on mount failure 2022-11-10 18:15:37 +01:00
sync.c vfs: make sync_filesystem return errors from ->sync_fs 2022-04-27 14:38:50 +02:00
timerfd.c
…
userfaultfd.c userfaultfd: open userfaultfds with O_RDONLY 2022-10-26 12:34:36 +02:00
utimes.c
…
xattr.c fs: split off setxattr_copy and do_setxattr function from setxattr 2022-10-05 10:39:44 +02:00