android/android_kernel_asus_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5da4c29d97
android_kernel_asus_sm8350/fs
History
Ye Bin 5da4c29d97 UPSTREAM: ext4: fix kernel BUG in 'ext4_write_inline_data_end()' 
commit 5c099c4fdc438014d5893629e70a8ba934433ee8 upstream.

Syzbot report follow issue:
------------[ cut here ]------------
kernel BUG at fs/ext4/inline.c:227!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 3629 Comm: syz-executor212 Not tainted 6.1.0-rc5-syzkaller-00018-g59d0d52c30d4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
RIP: 0010:ext4_write_inline_data+0x344/0x3e0 fs/ext4/inline.c:227
RSP: 0018:ffffc90003b3f368 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff8880704e16c0 RCX: 0000000000000000
RDX: ffff888021763a80 RSI: ffffffff821e31a4 RDI: 0000000000000006
RBP: 000000000006818e R08: 0000000000000006 R09: 0000000000068199
R10: 0000000000000079 R11: 0000000000000000 R12: 000000000000000b
R13: 0000000000068199 R14: ffffc90003b3f408 R15: ffff8880704e1c82
FS:  000055555723e3c0(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffe8ac9080 CR3: 0000000079f81000 CR4: 0000000000350ee0
Call Trace:
 <TASK>
 ext4_write_inline_data_end+0x2a3/0x12f0 fs/ext4/inline.c:768
 ext4_write_end+0x242/0xdd0 fs/ext4/inode.c:1313
 ext4_da_write_end+0x3ed/0xa30 fs/ext4/inode.c:3063
 generic_perform_write+0x316/0x570 mm/filemap.c:3764
 ext4_buffered_write_iter+0x15b/0x460 fs/ext4/file.c:285
 ext4_file_write_iter+0x8bc/0x16e0 fs/ext4/file.c:700
 call_write_iter include/linux/fs.h:2191 [inline]
 do_iter_readv_writev+0x20b/0x3b0 fs/read_write.c:735
 do_iter_write+0x182/0x700 fs/read_write.c:861
 vfs_iter_write+0x74/0xa0 fs/read_write.c:902
 iter_file_splice_write+0x745/0xc90 fs/splice.c:686
 do_splice_from fs/splice.c:764 [inline]
 direct_splice_actor+0x114/0x180 fs/splice.c:931
 splice_direct_to_actor+0x335/0x8a0 fs/splice.c:886
 do_splice_direct+0x1ab/0x280 fs/splice.c:974
 do_sendfile+0xb19/0x1270 fs/read_write.c:1255
 __do_sys_sendfile64 fs/read_write.c:1323 [inline]
 __se_sys_sendfile64 fs/read_write.c:1309 [inline]
 __x64_sys_sendfile64+0x1d0/0x210 fs/read_write.c:1309
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
---[ end trace 0000000000000000 ]---

Above issue may happens as follows:
ext4_da_write_begin
  ext4_da_write_inline_data_begin
    ext4_da_convert_inline_data_to_extent
      ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
ext4_da_write_end

ext4_run_li_request
  ext4_mb_prefetch
    ext4_read_block_bitmap_nowait
      ext4_validate_block_bitmap
        ext4_mark_group_bitmap_corrupted(sb, block_group, EXT4_GROUP_INFO_BBITMAP_CORRUPT)
	 percpu_counter_sub(&sbi->s_freeclusters_counter,grp->bb_free);
	  -> sbi->s_freeclusters_counter become zero
ext4_da_write_begin
  if (ext4_nonda_switch(inode->i_sb)) -> As freeclusters_counter is zero will return true
    *fsdata = (void *)FALL_BACK_TO_NONDELALLOC;
    ext4_write_begin
ext4_da_write_end
  if (write_mode == FALL_BACK_TO_NONDELALLOC)
    ext4_write_end
      if (inline_data)
        ext4_write_inline_data_end
	  ext4_write_inline_data
	    BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);
           -> As inode is already convert to extent, so 'pos + len' > inline_size
	   -> then trigger BUG.

To solve this issue, instead of checking ext4_has_inline_data() which
is only cleared after data has been written back, check the
EXT4_STATE_MAY_INLINE_DATA flag in ext4_write_end().

Fixes: f19d5870cb ("ext4: add normal write support for inline data")
Reported-by: syzbot+4faa160fa96bfba639f8@syzkaller.appspotmail.com
Reported-by: Jun Nie <jun.nie@linaro.org>
Signed-off-by: Ye Bin <yebin10@huawei.com>
Link: https://lore.kernel.org/r/20221206144134.1919987-1-yebin@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
[ta: Fix conflict in if expression and use the local variable inline_data
as it is initialized with ext4_has_inline_data(inode) anyway.]
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 257756238
Change-Id: Ifc77db2f12db2270a2f7100e548e113dee3ee492
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
2023-04-05 12:53:42 +00:00
..
9p This is the 5.4.200 stable release 2022-06-23 15:04:40 +02:00
adfs
affs affs: initialize fsdata in affs_truncate() 2023-02-06 07:52:36 +01:00
afs This is the 5.4.226 stable release 2022-12-08 16:50:20 +00:00
autofs autofs: fix a leak in autofs_expire_indirect() 2019-10-25 00:03:11 -04:00
befs
bfs bfs: don't use WARNING: string when it's just info. 2021-01-06 14:48:39 +01:00
btrfs This is the 5.4.232 stable release 2023-02-22 12:30:48 +00:00
cachefiles cachefiles: Handle readpage error correctly 2020-11-05 11:43:36 +01:00
ceph This is the 5.4.232 stable release 2023-02-22 12:30:48 +00:00
cifs This is the 5.4.231 stable release 2023-02-06 10:47:39 +00:00
coda y2038: add inode timestamp clamping 2019-09-19 09:42:37 -07:00
configfs configfs: fix possible memory leak in configfs_create_dir() 2023-01-18 11:41:09 +01:00
cramfs cramfs: fix usage on non-MTD device 2019-11-23 21:44:49 -05:00
crypto UPSTREAM: fscrypt: fix derivation of SipHash keys on big endian CPUs 2022-11-22 07:58:42 +00:00
debugfs debugfs: fix error when writing negative value to atomic_t debugfs file 2023-01-18 11:40:56 +01:00
devpts fsnotify: fix fsnotify hooks in pseudo filesystems 2022-02-01 17:24:34 +01:00
dlm fs: dlm: handle -EBUSY first in lock arg validation 2022-10-26 13:22:14 +02:00
ecryptfs This is the 5.4.122 stable release 2021-05-28 13:26:18 +02:00
efivarfs efivarfs: revert "fix memory leak in efivarfs_create()" 2020-12-02 08:49:53 +01:00
efs
erofs This is the 5.4.211 stable release 2022-08-25 12:12:16 +02:00
exportfs exportfs_decode_fh(): negative pinned may become positive without the parent locked 2019-11-10 11:56:05 -05:00
ext2 This is the 5.4.211 stable release 2022-08-25 12:12:16 +02:00
ext4 UPSTREAM: ext4: fix kernel BUG in 'ext4_write_inline_data_end()' 2023-04-05 12:53:42 +00:00
f2fs Merge tag 'android11-5.4.233_r00' into android11-5.4 2023-03-23 09:12:29 +00:00
fat fat: add ratelimit to fat*_ent_bread() 2022-06-14 18:11:30 +02:00
freevxfs
fscache fscache: Fix cookie key hashing 2021-09-22 12:26:25 +02:00
fuse This is the 5.4.226 stable release 2022-12-08 16:50:20 +00:00
gfs2 This is the 5.4.225 stable release 2022-11-29 16:39:04 +00:00
hfs This is the 5.4.229 stable release 2023-01-18 12:21:41 +00:00
hfsplus This is the 5.4.229 stable release 2023-01-18 12:21:41 +00:00
hostfs hostfs: fix memory handling in follow_link() 2021-04-14 08:24:14 +02:00
hpfs
hugetlbfs hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() 2023-01-18 11:41:38 +01:00
incfs ANDROID: incfs: Add check for ATTR_KILL_SUID and ATTR_MODE in incfs_setattr 2022-09-19 15:14:36 -07:00
iomap This is the 5.4.198 stable release 2022-06-21 14:58:56 +02:00
isofs isofs: Fix out of bound access for corrupted isofs image 2021-11-12 14:43:03 +01:00
jbd2 jbd2: wake up journal waiters in FIFO order, not LIFO 2022-10-26 13:22:17 +02:00
jffs2 This is the 5.4.198 stable release 2022-06-21 14:58:56 +02:00
jfs This is the 5.4.229 stable release 2023-01-18 12:21:41 +00:00
kernfs This is the 5.4.223 stable release 2022-11-16 16:06:47 +00:00
lockd lockd: lockd server-side shouldn't set fl_ops 2021-09-22 12:26:34 +02:00
minix minix: fix bug when opening a file with O_DIRECT 2022-04-15 14:18:35 +02:00
nfs This is the 5.4.230 stable release 2023-01-25 16:08:14 +00:00
nfs_common nfs_common: need lock during iterate through the list 2020-12-30 11:51:22 +01:00
nfsd nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted 2023-02-06 07:52:47 +01:00
nilfs2 nilfs2: fix underflow in second superblock position calculations 2023-02-22 12:50:41 +01:00
nls
notify This is the 5.4.198 stable release 2022-06-21 14:58:56 +02:00
ntfs ntfs: check overflow when iterating ATTR_RECORDs 2022-11-25 17:42:22 +01:00
ocfs2 This is the 5.4.229 stable release 2023-01-18 12:21:41 +00:00
omfs
openpromfs
orangefs This is the 5.4.229 stable release 2023-01-18 12:21:41 +00:00
overlayfs This is the 5.4.229 stable release 2023-01-18 12:21:41 +00:00
proc This is the 5.4.232 stable release 2023-02-22 12:30:48 +00:00
pstore pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES 2023-01-18 11:41:40 +01:00
qnx4 qnx4: work around gcc false positive warning bug 2021-09-30 10:09:26 +02:00
qnx6
quota ext4: fix bug_on in __es_tree_search caused by bad quota inode 2023-01-18 11:42:02 +01:00
ramfs ramfs: fix nommu mmap with gaps in the page cache 2020-10-29 09:57:53 +01:00
reiserfs This is the 5.4.231 stable release 2023-02-06 10:47:39 +00:00
romfs romfs: fix uninitialized memory leak in romfs_dev_read() 2020-08-26 10:40:51 +02:00
squashfs This is the 5.4.232 stable release 2023-02-22 12:30:48 +00:00
sysfs ANDROID: GKI: hack up fs/sysfs/file.c to prevent GENKSYMS change 2021-03-08 10:09:14 +01:00
sysv fs: sysv: Fix sysv_nblocks() returns wrong value 2023-01-18 11:40:58 +01:00
tracefs This is the 5.4.214 stable release 2022-09-21 16:30:56 +02:00
ubifs This is the 5.4.189 stable release 2022-04-19 16:29:31 +02:00
udf udf: Fix extension of the last extent in the file 2023-01-18 11:41:58 +01:00
ufs Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4" 2020-08-23 13:12:51 +02:00
unicode FROMLIST: unicode: Add utf8_casefold_hash 2020-02-20 21:21:02 +00:00
verity This is the 5.4.151 stable release 2021-10-06 15:51:50 +02:00
xfs This is the 5.4.232 stable release 2023-02-22 12:30:48 +00:00
aio.c aio: fix mremap after fork null-deref 2023-02-22 12:50:35 +01:00
anon_inodes.c
attr.c vfs: Check the truncate maximum size in inode_newsize_ok() 2022-08-25 11:17:21 +02:00
bad_inode.c
binfmt_aout.c binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf 2023-01-18 11:41:46 +01:00
binfmt_elf_fdpic.c binfmt: Fix error return code in load_elf_fdpic_binary() 2023-01-18 11:41:46 +01:00
binfmt_elf.c elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings 2021-10-06 15:42:35 +02:00
binfmt_em86.c
binfmt_flat.c binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf 2023-01-18 11:41:46 +01:00
binfmt_misc.c binfmt_misc: fix shift-out-of-bounds in check_special_flags 2023-01-18 11:41:33 +01:00
binfmt_script.c
block_dev.c block: reexpand iov_iter after read/write 2021-05-22 11:38:29 +02:00
buffer.c This is the 5.4.225 stable release 2022-11-29 16:39:04 +00:00
char_dev.c chardev: fix error handling in cdev_device_add() 2023-01-18 11:41:25 +01:00
compat_binfmt_elf.c
compat_ioctl.c compat_ioctl: remove /dev/random commands 2022-06-22 14:11:03 +02:00
compat.c
coredump.c coredump: fix core_pattern parse error 2020-12-11 13:23:30 +01:00
d_path.c fs: fix NULL dereference due to data race in prepend_path() 2020-10-29 09:57:45 +01:00
dax.c dax: fix cache flush on PMD-mapped pages 2022-06-14 18:11:41 +02:00
dcache.c fix dget_parent() fastpath race 2020-10-01 13:17:19 +02:00
dcookies.c
direct-io.c This is the 5.4.112 stable release 2021-04-14 12:07:53 +02:00
drop_caches.c fs: avoid softlockups in s_inodes iterators 2020-01-12 12:21:37 +01:00
eventfd.c eventfd: track eventfd_signal() recursion depth 2020-02-11 04:35:37 -08:00
eventpoll.c This is the 5.4.226 stable release 2022-12-08 16:50:20 +00:00
exec.c This is the 5.4.197 stable release 2022-06-06 11:06:30 +02:00
fcntl.c fcntl: fix potential deadlock for &fasync_struct.fa_lock 2021-09-15 09:47:28 +02:00
fhandle.c
file_table.c SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() 2022-05-25 09:14:34 +02:00
file.c fget: clarify and improve __fget_files() implementation 2022-03-02 11:41:18 +01:00
filesystems.c fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once() 2020-04-17 10:50:21 +02:00
fs_context.c memcg: charge fs_context and legacy_fs_context 2022-02-08 18:24:29 +01:00
fs_parser.c vfs: Make fs_parse() handle fs_param_is_fd-type params better 2019-09-12 21:06:14 -04:00
fs_pin.c
fs_struct.c Revert "ANDROID: sdcardfs: Enable modular sdcardfs" 2020-05-29 15:08:00 +02:00
fs_types.c
fs-writeback.c fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages 2022-06-14 18:11:44 +02:00
fsopen.c
inode.c This is the 5.4.218 stable release 2022-10-15 08:28:04 +02:00
internal.h cgroup1: fix leaked context root causing sporadic NULL deref in LTP 2021-07-31 08:19:37 +02:00
io_uring.c This is the 5.4.220 stable release 2022-10-29 10:45:08 +02:00
ioctl.c compat_ioctl: add compat_ptr_ioctl() 2019-12-17 19:55:30 +01:00
Kconfig ANDROID: sdcardfs: remove sdcardfs from system 2020-05-29 14:48:37 +02:00
Kconfig.binfmt
libfs.c This is the 5.4.229 stable release 2023-01-18 12:21:41 +00:00
locks.c locks: reinstate locks_delete_block optimization 2020-03-25 08:25:41 +01:00
Makefile ANDROID: GKI: set vfs-only exports into their own namespace 2020-07-07 18:07:10 +02:00
mbcache.c mbcache: Avoid nesting of cache->c_list_lock under bit locks 2023-01-18 11:41:59 +01:00
mount.h
mpage.c This is the 5.4.13 stable release 2020-01-17 23:38:39 +01:00
namei.c This is the 5.4.225 stable release 2022-11-29 16:39:04 +00:00
namespace.c Linux 5.4.143 2021-08-27 22:38:57 +02:00
no-block.c
nsfs.c
open.c ANDROID: GKI: set vfs-only exports into their own namespace 2020-07-07 18:07:10 +02:00
OWNERS ANDROID: Add OWNERS files referring to the respective android-mainline OWNERS 2021-04-01 13:45:14 +00:00
pipe.c pipe: increase minimum default pipe size to 2 pages 2021-08-12 13:21:02 +02:00
pnode.c This is the 5.4.229 stable release 2023-01-18 12:21:41 +00:00
pnode.h This is the 5.4.106 stable release 2021-03-17 17:55:32 +01:00
posix_acl.c FROMLIST: Add flags option to get xattr method paired to __vfs_getxattr 2019-11-05 13:50:57 -08:00
proc_namespace.c Merge 5.4-rc1-prelrease into android-mainline 2019-10-02 17:58:47 +02:00
read_write.c ANDROID: GKI: set vfs-only exports into their own namespace 2020-07-07 18:07:10 +02:00
readdir.c readdir: make sure to verify directory entry for legacy interfaces too 2021-04-21 12:56:16 +02:00
select.c select: Fix indefinitely sleeping task in poll_schedule_timeout() 2022-01-29 10:25:11 +01:00
seq_file.c seq_file: disallow extremely large seq buffer allocations 2021-07-20 16:10:54 +02:00
signalfd.c Revert "io_uring: disable polling pollfree files" 2022-09-21 15:47:16 +02:00
splice.c Revert "fs: check FMODE_LSEEK to control internal pipe splicing" 2022-10-17 17:24:32 +02:00
stack.c
stat.c This is the 5.4.191 stable release 2022-04-27 14:24:26 +02:00
statfs.c vfs: Fix EOVERFLOW testing in put_compat_statfs64 2019-10-03 14:21:35 -07:00
super.c vfs: make freeze_super abort when sync_filesystem returns error 2022-02-23 11:59:55 +01:00
sync.c
timerfd.c
userfaultfd.c This is the 5.4.220 stable release 2022-10-29 10:45:08 +02:00
utimes.c Revert "ANDROID: vfs: Add setattr2 for filesystems with per mount permissions" 2020-05-29 14:48:38 +02:00
xattr.c This is the 5.4.229 stable release 2023-01-18 12:21:41 +00:00