* [Cluster-devel] [PATCH 4.19/5.4/5.10 0/1] gfs2: Always check inode size of inline inodes
@ 2023-03-24 20:19 ` Fedor Pchelkin
0 siblings, 0 replies; 8+ messages in thread
From: Fedor Pchelkin @ 2023-03-24 20:19 UTC (permalink / raw)
To: cluster-devel.redhat.com
Kernel bug in iomap_read_inline_data() fixed by the following patch is hit
on older stables 4.19/5.4/5.10.
The patch failed to be initially backported into stable branches older
than 5.15 due to the upstream commit 7db354444ad8 ("gfs2: Cosmetic
gfs2_dinode_{in,out} cleanup").
Now it can be cleanly applied to the 4.19/5.4/5.10 stable branches.
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH 4.19/5.4/5.10 0/1] gfs2: Always check inode size of inline inodes @ 2023-03-24 20:19 ` Fedor Pchelkin 0 siblings, 0 replies; 8+ messages in thread From: Fedor Pchelkin @ 2023-03-24 20:19 UTC (permalink / raw) To: Greg Kroah-Hartman, stable Cc: Fedor Pchelkin, Andreas Gruenbacher, cluster-devel, linux-kernel, Alexey Khoroshilov, lvc-project Kernel bug in iomap_read_inline_data() fixed by the following patch is hit on older stables 4.19/5.4/5.10. The patch failed to be initially backported into stable branches older than 5.15 due to the upstream commit 7db354444ad8 ("gfs2: Cosmetic gfs2_dinode_{in,out} cleanup"). Now it can be cleanly applied to the 4.19/5.4/5.10 stable branches. ^ permalink raw reply [flat|nested] 8+ messages in thread
* [Cluster-devel] [PATCH 4.19/5.4/5.10 1/1] gfs2: Always check inode size of inline inodes 2023-03-24 20:19 ` Fedor Pchelkin @ 2023-03-24 20:19 ` Fedor Pchelkin -1 siblings, 0 replies; 8+ messages in thread From: Fedor Pchelkin @ 2023-03-24 20:19 UTC (permalink / raw) To: cluster-devel.redhat.com commit 70376c7ff31221f1d21db5611d8209e677781d3a upstream. Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk corruption. The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just truncate inline data to the maximum allowed size don't actually make sense, and they can be removed now as well. Reported-by: syzbot+7bb81dfa9cda07d9cd9d at syzkaller.appspotmail.com Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> [pchelkin at ispras.ru: adjust the inode variable inside gfs2_dinode_in with the format used before upstream commit 7db354444ad8 ("gfs2: Cosmetic gfs2_dinode_{in,out} cleanup")] Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> --- fs/gfs2/aops.c | 2 -- fs/gfs2/bmap.c | 3 --- fs/gfs2/glops.c | 3 +++ 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c index 530659554870..a0430da033b3 100644 --- a/fs/gfs2/aops.c +++ b/fs/gfs2/aops.c @@ -451,8 +451,6 @@ static int stuffed_readpage(struct gfs2_inode *ip, struct page *page) return error; kaddr = kmap_atomic(page); - if (dsize > gfs2_max_stuffed_size(ip)) - dsize = gfs2_max_stuffed_size(ip); memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); memset(kaddr + dsize, 0, PAGE_SIZE - dsize); kunmap_atomic(kaddr); diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c index b4fde3a8eeb4..eaee95d2ad14 100644 --- a/fs/gfs2/bmap.c +++ b/fs/gfs2/bmap.c @@ -69,9 +69,6 @@ static int gfs2_unstuffer_page(struct gfs2_inode *ip, struct buffer_head *dibh, void *kaddr = kmap(page); u64 dsize = i_size_read(inode); - if (dsize > gfs2_max_stuffed_size(ip)) - dsize = gfs2_max_stuffed_size(ip); - memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); memset(kaddr + dsize, 0, PAGE_SIZE - dsize); kunmap(page); diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c index bf539eab92c6..db28c240dae3 100644 --- a/fs/gfs2/glops.c +++ b/fs/gfs2/glops.c @@ -454,6 +454,9 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) ip->i_depth = (u8)depth; ip->i_entries = be32_to_cpu(str->di_entries); + if (gfs2_is_stuffed(ip) && ip->i_inode.i_size > gfs2_max_stuffed_size(ip)) + goto corrupt; + if (S_ISREG(ip->i_inode.i_mode)) gfs2_set_aops(&ip->i_inode); -- 2.34.1 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 4.19/5.4/5.10 1/1] gfs2: Always check inode size of inline inodes @ 2023-03-24 20:19 ` Fedor Pchelkin 0 siblings, 0 replies; 8+ messages in thread From: Fedor Pchelkin @ 2023-03-24 20:19 UTC (permalink / raw) To: Greg Kroah-Hartman, stable Cc: Fedor Pchelkin, Andreas Gruenbacher, cluster-devel, linux-kernel, Alexey Khoroshilov, lvc-project, syzbot+7bb81dfa9cda07d9cd9d commit 70376c7ff31221f1d21db5611d8209e677781d3a upstream. Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk corruption. The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just truncate inline data to the maximum allowed size don't actually make sense, and they can be removed now as well. Reported-by: syzbot+7bb81dfa9cda07d9cd9d@syzkaller.appspotmail.com Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> [pchelkin@ispras.ru: adjust the inode variable inside gfs2_dinode_in with the format used before upstream commit 7db354444ad8 ("gfs2: Cosmetic gfs2_dinode_{in,out} cleanup")] Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> --- fs/gfs2/aops.c | 2 -- fs/gfs2/bmap.c | 3 --- fs/gfs2/glops.c | 3 +++ 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c index 530659554870..a0430da033b3 100644 --- a/fs/gfs2/aops.c +++ b/fs/gfs2/aops.c @@ -451,8 +451,6 @@ static int stuffed_readpage(struct gfs2_inode *ip, struct page *page) return error; kaddr = kmap_atomic(page); - if (dsize > gfs2_max_stuffed_size(ip)) - dsize = gfs2_max_stuffed_size(ip); memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); memset(kaddr + dsize, 0, PAGE_SIZE - dsize); kunmap_atomic(kaddr); diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c index b4fde3a8eeb4..eaee95d2ad14 100644 --- a/fs/gfs2/bmap.c +++ b/fs/gfs2/bmap.c @@ -69,9 +69,6 @@ static int gfs2_unstuffer_page(struct gfs2_inode *ip, struct buffer_head *dibh, void *kaddr = kmap(page); u64 dsize = i_size_read(inode); - if (dsize > gfs2_max_stuffed_size(ip)) - dsize = gfs2_max_stuffed_size(ip); - memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); memset(kaddr + dsize, 0, PAGE_SIZE - dsize); kunmap(page); diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c index bf539eab92c6..db28c240dae3 100644 --- a/fs/gfs2/glops.c +++ b/fs/gfs2/glops.c @@ -454,6 +454,9 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) ip->i_depth = (u8)depth; ip->i_entries = be32_to_cpu(str->di_entries); + if (gfs2_is_stuffed(ip) && ip->i_inode.i_size > gfs2_max_stuffed_size(ip)) + goto corrupt; + if (S_ISREG(ip->i_inode.i_mode)) gfs2_set_aops(&ip->i_inode); -- 2.34.1 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* [Cluster-devel] [PATCH v2 4.19/5.4/5.10 1/1] gfs2: Always check inode size of inline inodes 2023-03-24 20:19 ` Fedor Pchelkin @ 2023-03-24 20:26 ` Fedor Pchelkin -1 siblings, 0 replies; 8+ messages in thread From: Fedor Pchelkin @ 2023-03-24 20:26 UTC (permalink / raw) To: cluster-devel.redhat.com From: Andreas Gruenbacher <agruenba@redhat.com> commit 70376c7ff31221f1d21db5611d8209e677781d3a upstream. Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk corruption. The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just truncate inline data to the maximum allowed size don't actually make sense, and they can be removed now as well. Reported-by: syzbot+7bb81dfa9cda07d9cd9d at syzkaller.appspotmail.com Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> [pchelkin at ispras.ru: adjust the inode variable inside gfs2_dinode_in with the format used before upstream commit 7db354444ad8 ("gfs2: Cosmetic gfs2_dinode_{in,out} cleanup")] Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> --- v2: add missed From: tag fs/gfs2/aops.c | 2 -- fs/gfs2/bmap.c | 3 --- fs/gfs2/glops.c | 3 +++ 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c index 530659554870..a0430da033b3 100644 --- a/fs/gfs2/aops.c +++ b/fs/gfs2/aops.c @@ -451,8 +451,6 @@ static int stuffed_readpage(struct gfs2_inode *ip, struct page *page) return error; kaddr = kmap_atomic(page); - if (dsize > gfs2_max_stuffed_size(ip)) - dsize = gfs2_max_stuffed_size(ip); memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); memset(kaddr + dsize, 0, PAGE_SIZE - dsize); kunmap_atomic(kaddr); diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c index b4fde3a8eeb4..eaee95d2ad14 100644 --- a/fs/gfs2/bmap.c +++ b/fs/gfs2/bmap.c @@ -69,9 +69,6 @@ static int gfs2_unstuffer_page(struct gfs2_inode *ip, struct buffer_head *dibh, void *kaddr = kmap(page); u64 dsize = i_size_read(inode); - if (dsize > gfs2_max_stuffed_size(ip)) - dsize = gfs2_max_stuffed_size(ip); - memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); memset(kaddr + dsize, 0, PAGE_SIZE - dsize); kunmap(page); diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c index bf539eab92c6..db28c240dae3 100644 --- a/fs/gfs2/glops.c +++ b/fs/gfs2/glops.c @@ -454,6 +454,9 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) ip->i_depth = (u8)depth; ip->i_entries = be32_to_cpu(str->di_entries); + if (gfs2_is_stuffed(ip) && ip->i_inode.i_size > gfs2_max_stuffed_size(ip)) + goto corrupt; + if (S_ISREG(ip->i_inode.i_mode)) gfs2_set_aops(&ip->i_inode); -- 2.34.1 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH v2 4.19/5.4/5.10 1/1] gfs2: Always check inode size of inline inodes @ 2023-03-24 20:26 ` Fedor Pchelkin 0 siblings, 0 replies; 8+ messages in thread From: Fedor Pchelkin @ 2023-03-24 20:26 UTC (permalink / raw) To: Greg Kroah-Hartman, stable Cc: Fedor Pchelkin, Andreas Gruenbacher, cluster-devel, linux-kernel, Alexey Khoroshilov, lvc-project, syzbot+7bb81dfa9cda07d9cd9d From: Andreas Gruenbacher <agruenba@redhat.com> commit 70376c7ff31221f1d21db5611d8209e677781d3a upstream. Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk corruption. The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just truncate inline data to the maximum allowed size don't actually make sense, and they can be removed now as well. Reported-by: syzbot+7bb81dfa9cda07d9cd9d@syzkaller.appspotmail.com Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> [pchelkin@ispras.ru: adjust the inode variable inside gfs2_dinode_in with the format used before upstream commit 7db354444ad8 ("gfs2: Cosmetic gfs2_dinode_{in,out} cleanup")] Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> --- v2: add missed From: tag fs/gfs2/aops.c | 2 -- fs/gfs2/bmap.c | 3 --- fs/gfs2/glops.c | 3 +++ 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c index 530659554870..a0430da033b3 100644 --- a/fs/gfs2/aops.c +++ b/fs/gfs2/aops.c @@ -451,8 +451,6 @@ static int stuffed_readpage(struct gfs2_inode *ip, struct page *page) return error; kaddr = kmap_atomic(page); - if (dsize > gfs2_max_stuffed_size(ip)) - dsize = gfs2_max_stuffed_size(ip); memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); memset(kaddr + dsize, 0, PAGE_SIZE - dsize); kunmap_atomic(kaddr); diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c index b4fde3a8eeb4..eaee95d2ad14 100644 --- a/fs/gfs2/bmap.c +++ b/fs/gfs2/bmap.c @@ -69,9 +69,6 @@ static int gfs2_unstuffer_page(struct gfs2_inode *ip, struct buffer_head *dibh, void *kaddr = kmap(page); u64 dsize = i_size_read(inode); - if (dsize > gfs2_max_stuffed_size(ip)) - dsize = gfs2_max_stuffed_size(ip); - memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode), dsize); memset(kaddr + dsize, 0, PAGE_SIZE - dsize); kunmap(page); diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c index bf539eab92c6..db28c240dae3 100644 --- a/fs/gfs2/glops.c +++ b/fs/gfs2/glops.c @@ -454,6 +454,9 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf) ip->i_depth = (u8)depth; ip->i_entries = be32_to_cpu(str->di_entries); + if (gfs2_is_stuffed(ip) && ip->i_inode.i_size > gfs2_max_stuffed_size(ip)) + goto corrupt; + if (S_ISREG(ip->i_inode.i_mode)) gfs2_set_aops(&ip->i_inode); -- 2.34.1 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* [Cluster-devel] [PATCH v2 4.19/5.4/5.10 1/1] gfs2: Always check inode size of inline inodes 2023-03-24 20:26 ` Fedor Pchelkin @ 2023-04-03 13:27 ` Greg Kroah-Hartman -1 siblings, 0 replies; 8+ messages in thread From: Greg Kroah-Hartman @ 2023-04-03 13:27 UTC (permalink / raw) To: cluster-devel.redhat.com On Fri, Mar 24, 2023 at 11:26:15PM +0300, Fedor Pchelkin wrote: > From: Andreas Gruenbacher <agruenba@redhat.com> > > commit 70376c7ff31221f1d21db5611d8209e677781d3a upstream. > > Check if the inode size of stuffed (inline) inodes is within the allowed > range when reading inodes from disk (gfs2_dinode_in()). This prevents > us from on-disk corruption. > > The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just > truncate inline data to the maximum allowed size don't actually make > sense, and they can be removed now as well. > > Reported-by: syzbot+7bb81dfa9cda07d9cd9d at syzkaller.appspotmail.com > Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> > [pchelkin at ispras.ru: adjust the inode variable inside gfs2_dinode_in with > the format used before upstream commit 7db354444ad8 ("gfs2: Cosmetic > gfs2_dinode_{in,out} cleanup")] > Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> > --- > v2: add missed From: tag Now queued up, thanks. greg k-h ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2 4.19/5.4/5.10 1/1] gfs2: Always check inode size of inline inodes @ 2023-04-03 13:27 ` Greg Kroah-Hartman 0 siblings, 0 replies; 8+ messages in thread From: Greg Kroah-Hartman @ 2023-04-03 13:27 UTC (permalink / raw) To: Fedor Pchelkin Cc: stable, Andreas Gruenbacher, cluster-devel, linux-kernel, Alexey Khoroshilov, lvc-project, syzbot+7bb81dfa9cda07d9cd9d On Fri, Mar 24, 2023 at 11:26:15PM +0300, Fedor Pchelkin wrote: > From: Andreas Gruenbacher <agruenba@redhat.com> > > commit 70376c7ff31221f1d21db5611d8209e677781d3a upstream. > > Check if the inode size of stuffed (inline) inodes is within the allowed > range when reading inodes from disk (gfs2_dinode_in()). This prevents > us from on-disk corruption. > > The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just > truncate inline data to the maximum allowed size don't actually make > sense, and they can be removed now as well. > > Reported-by: syzbot+7bb81dfa9cda07d9cd9d@syzkaller.appspotmail.com > Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> > [pchelkin@ispras.ru: adjust the inode variable inside gfs2_dinode_in with > the format used before upstream commit 7db354444ad8 ("gfs2: Cosmetic > gfs2_dinode_{in,out} cleanup")] > Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> > --- > v2: add missed From: tag Now queued up, thanks. greg k-h ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2023-04-03 13:28 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2023-03-24 20:19 [Cluster-devel] [PATCH 4.19/5.4/5.10 0/1] gfs2: Always check inode size of inline inodes Fedor Pchelkin 2023-03-24 20:19 ` Fedor Pchelkin 2023-03-24 20:19 ` [Cluster-devel] [PATCH 4.19/5.4/5.10 1/1] " Fedor Pchelkin 2023-03-24 20:19 ` Fedor Pchelkin 2023-03-24 20:26 ` [Cluster-devel] [PATCH v2 " Fedor Pchelkin 2023-03-24 20:26 ` Fedor Pchelkin 2023-04-03 13:27 ` [Cluster-devel] " Greg Kroah-Hartman 2023-04-03 13:27 ` Greg Kroah-Hartman
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.