android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
731011ac6c
android_kernel_xiaomi_sm8450/fs
History
Ryusuke Konishi 731011ac6c nilfs2: fix inode number range checks 
commit e2fec219a36e0993642844be0f345513507031f4 upstream.

Patch series "nilfs2: fix potential issues related to reserved inodes".

This series fixes one use-after-free issue reported by syzbot, caused by
nilfs2's internal inode being exposed in the namespace on a corrupted
filesystem, and a couple of flaws that cause problems if the starting
number of non-reserved inodes written in the on-disk super block is
intentionally (or corruptly) changed from its default value.


This patch (of 3):

In the current implementation of nilfs2, "nilfs->ns_first_ino", which
gives the first non-reserved inode number, is read from the superblock,
but its lower limit is not checked.

As a result, if a number that overlaps with the inode number range of
reserved inodes such as the root directory or metadata files is set in the
super block parameter, the inode number test macros (NILFS_MDT_INODE and
NILFS_VALID_INODE) will not function properly.

In addition, these test macros use left bit-shift calculations using with
the inode number as the shift count via the BIT macro, but the result of a
shift calculation that exceeds the bit width of an integer is undefined in
the C specification, so if "ns_first_ino" is set to a large value other
than the default value NILFS_USER_INO (=11), the macros may potentially
malfunction depending on the environment.

Fix these issues by checking the lower bound of "nilfs->ns_first_ino" and
by preventing bit shifts equal to or greater than the NILFS_USER_INO
constant in the inode number test macros.

Also, change the type of "ns_first_ino" from signed integer to unsigned
integer to avoid the need for type casting in comparisons such as the
lower bound check introduced this time.

Link: https://lkml.kernel.org/r/20240623051135.4180-1-konishi.ryusuke@gmail.com
Link: https://lkml.kernel.org/r/20240623051135.4180-2-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: Hillf Danton <hdanton@sina.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-07-18 13:05:42 +02:00
..
9p fs/9p: drop inodes immediately on non-.L too 2024-05-17 11:48:05 +02:00
adfs Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-10-24 12:26:05 -07:00
affs affs: initialize fsdata in affs_truncate() 2023-02-01 08:23:11 +01:00
afs afs: Don't cross .backup mountpoint from backup volume 2024-06-16 13:32:30 +02:00
autofs file: Replace ksys_close with close_fd 2024-06-21 14:52:50 +02:00
befs [PATCH] reduce boilerplate in fsid handling 2020-09-18 16:45:50 -04:00
bfs bfs: don't use WARNING: string when it's just info. 2021-01-06 14:56:52 +01:00
btrfs btrfs: fix leak of qgroup extent records after transaction abort 2024-07-05 09:12:25 +02:00
cachefiles namei: introduce struct renamedata 2024-06-21 14:52:59 +02:00
ceph ceph: prevent use-after-free in encode_cap_msg() 2024-02-23 08:42:29 +01:00
cifs smb: client: fix deadlock in smb2_find_smb_tcon() 2024-07-05 09:12:45 +02:00
coda coda: Avoid partial allocation of sig_inputArgs 2023-03-11 16:39:51 +01:00
configfs Revert "configfs: fix a race in configfs_lookup()" 2023-09-21 09:45:15 +02:00
cramfs [PATCH] reduce boilerplate in fsid handling 2020-09-18 16:45:50 -04:00
crypto fscrypt: fix keyring memory leak on mount failure 2022-11-10 18:14:25 +01:00
debugfs debugfs: fix automount d_fsdata usage 2024-01-25 14:37:36 -08:00
devpts fsnotify: fix fsnotify hooks in pseudo filesystems 2022-02-01 17:25:39 +01:00
dlm dlm: fix plock lookup when using multiple lockspaces 2023-09-19 12:20:22 +02:00
ecryptfs namei: introduce struct renamedata 2024-06-21 14:52:59 +02:00
efivarfs efivarfs: force RO when remounting if SetVariable is not supported 2024-01-25 14:37:40 -08:00
efs [PATCH] reduce boilerplate in fsid handling 2020-09-18 16:45:50 -04:00
erofs erofs: fix lz4 inplace decompression 2024-03-01 13:16:48 +01:00
exfat exfat: support handle zero-size directory 2023-11-28 16:54:52 +00:00
exportfs exportfs: use pr_debug for unreachable debug statements 2024-06-21 14:54:05 +02:00
ext2 ext2: fix datatype of block number in ext2_xattr_set2() 2023-09-23 11:01:07 +02:00
ext4 ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() 2024-06-16 13:32:36 +02:00
f2fs f2fs: remove clear SB_INLINECRYPT flag in default_options 2024-07-05 09:12:36 +02:00
fat fat: fix uninitialized field in nostale filehandles 2024-04-13 12:58:08 +02:00
freevxfs
fscache fscache: Fix cookie key hashing 2021-09-18 13:40:15 +02:00
fuse fuse: don't unhash root 2024-04-13 12:58:19 +02:00
gfs2 gfs2: Fix "ignore unlock failures after withdraw" 2024-06-16 13:32:05 +02:00
hfs hfs: fix missing hfs_bnode_get() in __hfs_bnode_create 2023-03-11 16:39:55 +01:00
hfsplus fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() 2023-05-30 12:57:47 +01:00
hostfs hostfs: fix memory handling in follow_link() 2021-04-14 08:42:06 +02:00
hpfs [PATCH] reduce boilerplate in fsid handling 2020-09-18 16:45:50 -04:00
hugetlbfs mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE 2024-03-15 10:48:22 -04:00
iomap xfs: use current->journal_info for detecting transaction recursion 2022-07-07 17:52:19 +02:00
isofs isofs: handle CDs with bad root inode but good Joliet root directory 2024-04-13 12:59:46 +02:00
jbd2 jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint 2024-03-01 13:16:47 +01:00
jffs2 jffs2: Fix potential illegal address access in jffs2_free_inode 2024-07-18 13:05:41 +02:00
jfs jfs: xattr: fix buffer overflow for invalid xattr 2024-07-05 09:12:25 +02:00
kernfs fs/kernfs/dir: obey S_ISGID 2024-02-23 08:42:14 +01:00
lockd lockd: drop inappropriate svc_get() from locked_get() 2024-06-21 14:54:14 +02:00
minix minix: fix bug when opening a file with O_DIRECT 2022-04-13 21:01:01 +02:00
nfs nfs: Leave pages in the pagecache if readpage failed 2024-07-05 09:12:55 +02:00
nfs_common NFSD: Add an xdr_stream-based encoder for NFSv2/3 ACLs 2024-06-21 14:53:03 +02:00
nfsd nfsd: hold a lighter-weight client reference over CB_RECALL_ANY 2024-07-05 09:12:48 +02:00
nilfs2 nilfs2: fix inode number range checks 2024-07-18 13:05:42 +02:00
nls fs/nls: make load_nls() take a const parameter 2023-09-19 12:20:04 +02:00
notify fanotify: Remove obsoleted fanotify_event_has_path() 2024-06-21 14:54:03 +02:00
ntfs ntfs: check overflow when iterating ATTR_RECORDs 2022-11-25 17:45:57 +01:00
ocfs2 ocfs2: fix DIO failure due to insufficient transaction credits 2024-07-05 09:12:51 +02:00
omfs fs: omfs: use kmemdup() rather than kmalloc+memcpy 2020-09-22 23:39:45 -04:00
openpromfs openpromfs: finish conversion to the new mount API 2024-06-16 13:32:01 +02:00
orangefs orangefs: fix out-of-bounds fsid access 2024-07-18 13:05:40 +02:00
overlayfs namei: introduce struct renamedata 2024-06-21 14:52:59 +02:00
proc fs/proc: fix softlockup in __read_vmcore 2024-07-05 09:12:30 +02:00
pstore pstore/zone: Add a null pointer check to the psz_kmsg_read 2024-04-13 12:59:41 +02:00
qnx4 qnx4: work around gcc false positive warning bug 2021-09-30 10:11:08 +02:00
qnx6 [PATCH] reduce boilerplate in fsid handling 2020-09-18 16:45:50 -04:00
quota quota: Fix rcu annotations of inode dquot pointers 2024-03-26 18:21:56 -04:00
ramfs shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs 2023-07-27 08:44:13 +02:00
reiserfs reiserfs: Check the return value from __getblk() 2023-09-19 12:20:06 +02:00
romfs Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-10-24 12:26:05 -07:00
squashfs revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" 2023-02-22 12:55:56 +01:00
sysfs fs: sysfs: Fix reference leak in sysfs_break_active_protection() 2024-05-02 16:23:39 +02:00
sysv sysv: don't call sb_bread() with pointers_lock held 2024-04-13 12:59:45 +02:00
tracefs tracefs: Add missing lockdown check to tracefs_create_dir() 2023-09-23 11:01:10 +02:00
ubifs ubifs: Set page uptodate in the correct place 2024-04-13 12:58:09 +02:00
udf udf: udftime: prevent overflow in udf_disk_stamp_to_time() 2024-07-05 09:12:36 +02:00
ufs Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-10-24 12:26:05 -07:00
unicode unicode: Add utf8_casefold_hash 2020-09-10 14:03:31 -07:00
vboxsf vboxsf: Avoid an spurious warning if load_nls_xxx() fails 2024-04-13 12:59:25 +02:00
verity fs: add file and path permissions helpers 2024-06-21 14:52:58 +02:00
xfs xfs: verify buffer contents when we skip log replay 2023-06-14 11:09:59 +02:00
zonefs zonefs: Improve error handling 2024-03-01 13:16:43 +01:00
aio.c fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion 2024-04-13 12:58:53 +02:00
anon_inodes.c
attr.c attr: block mode changes of symlinks 2023-09-23 11:01:09 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c fs: binfmt_elf_efpic: fix personality for ELF-FDPIC 2023-10-10 21:53:35 +02:00
binfmt_elf.c fs/binfmt_elf: Fix memory leak in load_elf_binary() 2022-11-03 23:57:49 +09:00
binfmt_em86.c
binfmt_flat.c binfmt_flat: do not stop relocating GOT entries prematurely on riscv 2022-06-09 10:20:47 +02:00
binfmt_misc.c binfmt_misc: fix shift-out-of-bounds in check_special_flags 2023-01-14 10:16:13 +01:00
binfmt_script.c
block_dev.c block: Don't invalidate pagecache for invalid falloc modes 2024-01-15 18:48:03 +01:00
buffer.c mm: fs: initialize fsdata passed to write_begin/write_end interface 2022-11-25 17:45:56 +01:00
char_dev.c chardev: fix error handling in cdev_device_add() 2023-01-14 10:15:59 +01:00
compat_binfmt_elf.c
coredump.c exec: Simplify unshare_files 2024-06-21 14:52:47 +02:00
d_path.c fs: fix NULL dereference due to data race in prepend_path() 2020-10-14 14:54:45 -07:00
dax.c dax: fix cache flush on PMD-mapped pages 2022-06-09 10:21:16 +02:00
dcache.c fast_dput(): handle underflows gracefully 2024-02-23 08:42:10 +01:00
dcookies.c
direct-io.c fs: direct-io: fix missing sdio->boundary 2021-04-14 08:41:58 +02:00
drop_caches.c
eventfd.c eventfd: prevent underflow for eventfd semaphores 2023-09-19 12:20:06 +02:00
eventpoll.c epoll: ep_autoremove_wake_function should use list_del_init_careful 2023-06-21 15:45:37 +02:00
exec.c exec: Simplify unshare_files 2024-06-21 14:52:47 +02:00
fcntl.c fcntl: fix potential deadlocks for &fown_struct.lock 2022-10-30 09:41:18 +01:00
fhandle.c do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak 2024-03-26 18:21:47 -04:00
file_table.c SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() 2022-05-18 10:23:48 +02:00
file.c file: Rename __close_fd to close_fd and remove the files parameter 2024-06-21 14:52:49 +02:00
filesystems.c
fs_context.c fs: avoid empty option when generating legacy mount string 2023-07-27 08:44:13 +02:00
fs_parser.c fs_parse: mark fs_param_bad_value() as static 2020-10-13 18:38:27 -07:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c writeback: fix call of incorrect macro 2023-05-17 11:48:10 +02:00
fsopen.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
init.c fs: add file and path permissions helpers 2024-06-21 14:52:58 +02:00
inode.c fs: add ctime accessors infrastructure 2023-12-08 08:46:15 +01:00
internal.h fs: Establish locking order for unrelated directories 2023-07-27 08:44:13 +02:00
ioctl.c lsm: new security_file_ioctl_compat() hook 2024-02-23 08:41:53 +01:00
Kconfig NFSD: Remove CONFIG_NFSD_V3 2024-06-21 14:53:37 +02:00
Kconfig.binfmt
kernel_read_file.c vfs: check fd has read access in kernel_read_file_from_fd() 2021-10-27 09:56:51 +02:00
libfs.c libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value 2023-01-14 10:15:19 +01:00
locks.c filelock: add a new locks_inode_context accessor function 2024-06-21 14:54:04 +02:00
Makefile io_uring: import 5.15-stable io_uring 2023-01-04 11:39:23 +01:00
mbcache.c mbcache: Avoid nesting of cache->c_list_lock under bit locks 2023-01-14 10:16:50 +01:00
mount.h
mpage.c
namei.c namei: introduce struct renamedata 2024-06-21 14:52:59 +02:00
namespace.c fs: indicate request originates from old mount API 2024-01-25 14:37:42 -08:00
no-block.c
nsfs.c
open.c ftruncate: pass a signed offset 2024-07-05 09:12:55 +02:00
pipe.c pipe: wakeup wr_wait after setting max_usage 2024-02-23 08:42:00 +01:00
pnode.c pnode: terminate at peers of source 2023-01-14 10:16:27 +01:00
pnode.h mount: fix mounting of detached mounts onto targets that reside on shared mounts 2021-03-17 17:06:13 +01:00
posix_acl.c
proc_namespace.c proc mountinfo: make splice available again 2020-12-30 11:54:02 +01:00
read_write.c vfs: fix copy_file_range() averts filesystem freeze protection 2022-12-19 12:27:30 +01:00
readdir.c readdir: make sure to verify directory entry for legacy interfaces too 2021-04-21 13:00:54 +02:00
remap_range.c fs/remap: constrain dedupe of EOF blocks 2022-07-21 21:20:01 +02:00
select.c fs/select: rework stack allocation hack for clang 2024-03-26 18:21:47 -04:00
seq_file.c seq_file: disallow extremely large seq buffer allocations 2021-07-20 16:05:59 +02:00
signalfd.c io_uring: disable polling pollfree files 2022-09-05 10:28:58 +02:00
splice.c Revert "fs: check FMODE_LSEEK to control internal pipe splicing" 2022-10-17 17:26:07 +02:00
stack.c
stat.c stat: fix inconsistency between struct stat and struct compat_stat 2022-04-27 13:53:54 +02:00
statfs.c statfs: enforce statfs[64] structure initialization 2023-05-30 12:57:55 +01:00
super.c fs: Protect reconfiguration of sb read-write from racing writes 2023-08-11 11:57:54 +02:00
sync.c vfs: make sync_filesystem return errors from ->sync_fs 2022-08-31 17:15:14 +02:00
timerfd.c
userfaultfd.c userfaultfd: open userfaultfds with O_RDONLY 2022-10-26 13:25:17 +02:00
utimes.c
xattr.c fs: don't audit the capability check in simple_xattr_list() 2023-01-14 10:15:16 +01:00