android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
android_kernel_xiaomi_sm8450/fs
History
Chandan Rajendra 9d5afec6b8 ext4: fix crash when a directory's i_size is too small 
On a ppc64 machine, when mounting a fuzzed ext2 image (generated by
fsfuzzer) the following call trace is seen,

VFS: brelse: Trying to free free buffer
WARNING: CPU: 1 PID: 6913 at /root/repos/linux/fs/buffer.c:1165 .__brelse.part.6+0x24/0x40
.__brelse.part.6+0x20/0x40 (unreliable)
.ext4_find_entry+0x384/0x4f0
.ext4_lookup+0x84/0x250
.lookup_slow+0xdc/0x230
.walk_component+0x268/0x400
.path_lookupat+0xec/0x2d0
.filename_lookup+0x9c/0x1d0
.vfs_statx+0x98/0x140
.SyS_newfstatat+0x48/0x80
system_call+0x58/0x6c

This happens because the directory that ext4_find_entry() looks up has
inode->i_size that is less than the block size of the filesystem. This
causes 'nblocks' to have a value of zero. ext4_bread_batch() ends up not
reading any of the directory file's blocks. This renders the entries in
bh_use[] array to continue to have garbage data. buffer_uptodate() on
bh_use[0] can then return a zero value upon which brelse() function is
invoked.

This commit fixes the bug by returning -ENOENT when the directory file
has no associated blocks.

Reported-by: Abdul Haleem <abdhalee@linux.vnet.ibm.com>
Signed-off-by: Chandan Rajendra <chandan@linux.vnet.ibm.com>
Cc: stable@vger.kernel.org
2017-12-11 15:00:57 -05:00
..
9p
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
adfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
affs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
afs
afs: Properly reset afs_vnode (inode) fields
2017-12-01 11:51:24 +00:00
autofs4
autofs: revert "autofs: take more care to not update last_used on path walk"
2017-11-29 18:40:43 -08:00
befs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
bfs
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
btrfs
for-4.15-rc2-tag
2017-11-29 14:26:50 -08:00
cachefiles
mm: remove __GFP_COLD
2017-11-15 18:21:06 -08:00
ceph
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
cifs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
coda
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
configfs
configfs: make ci_type field, some pointers and function arguments const
2017-10-19 16:15:16 +02:00
cramfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
crypto
fscrypt: lots of cleanups, mostly courtesy by Eric Biggers
2017-11-14 11:35:15 -08:00
debugfs
debugfs: Remove redundant license text
2017-11-07 20:25:03 +01:00
devpts
pty: Repair TIOCGPTPEER
2017-08-24 13:23:03 -07:00
dlm
A couple of configfs cleanups:
2017-11-14 14:44:04 -08:00
ecryptfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
efivarfs
VFS: Kill off s_options and helpers
2017-07-11 06:09:21 -04:00
efs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
exofs
Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block
2017-09-07 11:59:42 -07:00
exportfs
…
ext2
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
ext4
ext4: fix crash when a directory's i_size is too small
2017-12-11 15:00:57 -05:00
f2fs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
fat
fs/fat/inode.c: fix sb_rdonly() change
2017-11-29 18:40:43 -08:00
freevxfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
fscache
AFS development
2017-11-16 11:41:22 -08:00
fuse
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
gfs2
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
hfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
hfsplus
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
hostfs
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
hpfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
hugetlbfs
fs/hugetlbfs/inode.c: change put_page/unlock_page order in hugetlbfs_fallocate()
2017-11-29 18:40:43 -08:00
isofs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
jbd2
libnvdimm for 4.15
2017-11-17 09:51:57 -08:00
jffs2
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
jfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
kernfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
lockd
nlm_shutdown_hosts_net() cleanup
2017-11-27 16:45:11 -05:00
minix
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
ncpfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
nfs
NFS client fixes for Linux 4.15-rc2
2017-12-01 20:04:20 -05:00
nfs_common
lockd: fix "list_add double add" caused by legacy signal interface
2017-11-27 16:45:11 -05:00
nfsd
lockd: fix "list_add double add" caused by legacy signal interface
2017-11-27 16:45:11 -05:00
nilfs2
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
nls
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
notify
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
ntfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
ocfs2
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
omfs
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
openpromfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
orangefs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
overlayfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
proc
proc: don't report kernel addresses in /proc/<pid>/stack
2017-11-27 16:45:56 -08:00
pstore
treewide: Switch DEFINE_TIMER callbacks to struct timer_list *
2017-11-21 15:57:05 -08:00
qnx4
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
qnx6
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
quota
quota: Check for register_shrinker() failure.
2017-11-29 16:46:48 +01:00
ramfs
mm: make pagevec_lookup() update index
2017-09-06 17:27:26 -07:00
reiserfs
Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2017-11-30 18:38:47 -05:00
romfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
squashfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
sysfs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
sysv
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
tracefs
VFS: Don't use save/replace_mount_options if not using generic_show_options
2017-07-06 03:31:46 -04:00
ubifs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
udf
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
ufs
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
xfs
Changes since last update:
2017-12-01 20:00:19 -05:00
aio.c
Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 11:54:55 -08:00
anon_inodes.c
…
attr.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
bad_inode.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
binfmt_aout.c
fs: fix kernel_read prototype
2017-09-04 19:05:15 -04:00
binfmt_elf_fdpic.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:54:01 -08:00
binfmt_elf.c
Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm
2017-11-16 12:50:35 -08:00
binfmt_em86.c
…
binfmt_flat.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
binfmt_misc.c
fs/binfmt_misc.c: node could be NULL when evicting inode
2017-10-13 16:18:33 -07:00
binfmt_script.c
exec: load_script: kill the onstack interp[BINPRM_BUF_SIZE] array
2017-10-03 17:54:25 -07:00
block_dev.c
Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block
2017-11-14 15:32:19 -08:00
buffer.c
mm, pagevec: remove cold parameter for pagevecs
2017-11-15 18:21:06 -08:00
char_dev.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
compat_binfmt_elf.c
…
compat_ioctl.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:54:01 -08:00
compat.c
fs/compat.c: trim unused includes
2017-04-17 12:52:27 -04:00
coredump.c
Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 11:54:55 -08:00
dax.c
mm: replace pmd_write with pmd_access_permitted in fault + gup paths
2017-11-29 18:40:42 -08:00
dcache.c
kmemcheck: remove annotations
2017-11-15 18:21:04 -08:00
dcookies.c
…
direct-io.c
Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block
2017-11-14 15:32:19 -08:00
drop_caches.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
eventfd.c
There has been a fair amount of activity in the docs tree this time
2017-07-03 21:13:25 -07:00
eventpoll.c
Merge branch 'akpm' (patches from Andrew)
2017-11-17 16:56:17 -08:00
exec.c
exec: avoid RLIMIT_STACK races with prlimit()
2017-11-29 18:40:42 -08:00
fcntl.c
fcntl: don't cap l_start and l_end values for F_GETLK64 in compat syscall
2017-11-15 08:08:36 -05:00
fhandle.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:54:01 -08:00
file_table.c
fs, mm: account filp cache to kmemcg
2017-11-15 18:21:04 -08:00
file.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:54:01 -08:00
filesystems.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
fs_pin.c
Merge branch 'linus' into locking/core, to resolve conflicts
2017-11-07 10:32:44 +01:00
fs_struct.c
…
fs-writeback.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
inode.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
internal.h
fs: expose do_unlinkat for built-in callers
2017-11-10 08:48:46 -05:00
ioctl.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
iomap.c
Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:08:18 -08:00
Kconfig
fs/Kconfig: kill CONFIG_PERCPU_RWSEM some more
2017-07-12 16:26:00 -07:00
Kconfig.binfmt
ARM: enable elf_fdpic on systems with an MMU
2017-09-10 19:31:46 -04:00
libfs.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
locks.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
Makefile
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
mbcache.c
fs/mbcache.c: make count_objects() more robust
2017-11-29 18:40:43 -08:00
mount.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
mpage.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
namei.c
autofs: revert "autofs: fix AT_NO_AUTOMOUNT not being honored"
2017-11-29 18:40:43 -08:00
namespace.c
vfs: fix mounting a filesystem with i_version
2017-11-08 15:16:36 -05:00
no-block.c
…
nsfs.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
open.c
ovl: don't allow writing ioctl on lower layer
2017-09-05 12:53:12 +02:00
pipe.c
pipe: add proc_dopipe_max_size() to safely assign pipe_max_size
2017-11-17 16:10:03 -08:00
pnode.c
mnt: Make propagate_umount less slow for overlapping mount propagation trees
2017-05-23 08:41:17 -05:00
pnode.h
…
posix_acl.c
…
proc_namespace.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
read_write.c
Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:08:18 -08:00
readdir.c
Merge branch 'linus' into locking/core, to resolve conflicts
2017-11-07 10:32:44 +01:00
select.c
Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 11:54:55 -08:00
seq_file.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
signalfd.c
Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 11:54:55 -08:00
splice.c
locking/atomics: COCCINELLE/treewide: Convert trivial ACCESS_ONCE() patterns to READ_ONCE()/WRITE_ONCE()
2017-10-25 11:01:08 +02:00
stack.c
…
stat.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
statfs.c
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
super.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-11-17 12:54:01 -08:00
sync.c
Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block
2017-11-14 15:32:19 -08:00
timerfd.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
userfaultfd.c
userfaultfd: use mmgrab instead of open-coded increment of mm_count
2017-11-15 18:21:05 -08:00
utimes.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
xattr.c
lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
2017-10-04 18:03:15 +11:00