From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev,
syzbot+ec07f6f5ce62b858579f@syzkaller.appspotmail.com,
Dmitry Safonov <dima@arista.com>,
Amir Goldstein <amir73il@gmail.com>,
Christian Brauner <brauner@kernel.org>
Subject: [PATCH 6.6 68/72] fs: relax assertions on failure to encode file handles
Date: Tue, 21 Jan 2025 18:52:34 +0100 [thread overview]
Message-ID: <20250121174526.052498309@linuxfoundation.org> (raw)
In-Reply-To: <20250121174523.429119852@linuxfoundation.org>
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <amir73il@gmail.com>
commit 974e3fe0ac61de85015bbe5a4990cf4127b304b2 upstream.
Encoding file handles is usually performed by a filesystem >encode_fh()
method that may fail for various reasons.
The legacy users of exportfs_encode_fh(), namely, nfsd and
name_to_handle_at(2) syscall are ready to cope with the possibility
of failure to encode a file handle.
There are a few other users of exportfs_encode_{fh,fid}() that
currently have a WARN_ON() assertion when ->encode_fh() fails.
Relax those assertions because they are wrong.
The second linked bug report states commit 16aac5ad1fa9 ("ovl: support
encoding non-decodable file handles") in v6.6 as the regressing commit,
but this is not accurate.
The aforementioned commit only increases the chances of the assertion
and allows triggering the assertion with the reproducer using overlayfs,
inotify and drop_caches.
Triggering this assertion was always possible with other filesystems and
other reasons of ->encode_fh() failures and more particularly, it was
also possible with the exact same reproducer using overlayfs that is
mounted with options index=on,nfs_export=on also on kernels < v6.6.
Therefore, I am not listing the aforementioned commit as a Fixes commit.
Backport hint: this patch will have a trivial conflict applying to
v6.6.y, and other trivial conflicts applying to stable kernels < v6.6.
Reported-by: syzbot+ec07f6f5ce62b858579f@syzkaller.appspotmail.com
Tested-by: syzbot+ec07f6f5ce62b858579f@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-unionfs/671fd40c.050a0220.4735a.024f.GAE@google.com/
Reported-by: Dmitry Safonov <dima@arista.com>
Closes: https://lore.kernel.org/linux-fsdevel/CAGrbwDTLt6drB9eaUagnQVgdPBmhLfqqxAf3F+Juqy_o6oP8uw@mail.gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Link: https://lore.kernel.org/r/20241219115301.465396-1-amir73il@gmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/notify/fdinfo.c | 4 +---
fs/overlayfs/copy_up.c | 5 ++---
2 files changed, 3 insertions(+), 6 deletions(-)
--- a/fs/notify/fdinfo.c
+++ b/fs/notify/fdinfo.c
@@ -51,10 +51,8 @@ static void show_mark_fhandle(struct seq
size = f.handle.handle_bytes >> 2;
ret = exportfs_encode_fid(inode, (struct fid *)f.handle.f_handle, &size);
- if ((ret == FILEID_INVALID) || (ret < 0)) {
- WARN_ONCE(1, "Can't encode file handler for inotify: %d\n", ret);
+ if ((ret == FILEID_INVALID) || (ret < 0))
return;
- }
f.handle.handle_type = ret;
f.handle.handle_bytes = size * sizeof(u32);
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -399,9 +399,8 @@ struct ovl_fh *ovl_encode_real_fh(struct
buflen = (dwords << 2);
err = -EIO;
- if (WARN_ON(fh_type < 0) ||
- WARN_ON(buflen > MAX_HANDLE_SZ) ||
- WARN_ON(fh_type == FILEID_INVALID))
+ if (fh_type < 0 || fh_type == FILEID_INVALID ||
+ WARN_ON(buflen > MAX_HANDLE_SZ))
goto out_err;
fh->fb.version = OVL_FH_VERSION;
next prev parent reply other threads:[~2025-01-21 17:56 UTC|newest]
Thread overview: 83+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-01-21 17:51 [PATCH 6.6 00/72] 6.6.74-rc1 review Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 01/72] net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field() Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 02/72] bpf: Fix bpf_sk_select_reuseport() memory leak Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 03/72] openvswitch: fix lockup on tx to unregistering netdev with carrier Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 04/72] pktgen: Avoid out-of-bounds access in get_imix_entries Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 05/72] net: add exit_batch_rtnl() method Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 06/72] gtp: use " Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 07/72] gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp() Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 08/72] gtp: Destroy device along with udp sockets netns dismantle Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 09/72] nfp: bpf: prevent integer overflow in nfp_bpf_event_output() Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 10/72] net: xilinx: axienet: Fix IRQ coalescing packet count overflow Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 11/72] net: fec: handle page_pool_dev_alloc_pages error Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 12/72] net/mlx5: Fix RDMA TX steering prio Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 13/72] net/mlx5: Clear port select structure when fail to create Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 14/72] net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 15/72] net/mlx5e: Rely on reqid in IPsec tunnel mode Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 16/72] net/mlx5e: Always start IPsec sequence number from 1 Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 17/72] drm/vmwgfx: Add new keep_resv BO param Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 18/72] drm/v3d: Ensure job pointer is set to NULL after job completion Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 19/72] soc: ti: pruss: Fix pruss APIs Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 20/72] hwmon: (tmp513) Fix division of negative numbers Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 21/72] Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data" Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 22/72] i2c: mux: demux-pinctrl: check initial mux selection, too Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 23/72] i2c: rcar: fix NACK handling when being a target Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 24/72] smb: client: fix double free of TCP_Server_Info::hostname Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 25/72] mac802154: check local interfaces before deleting sdata list Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 26/72] hfs: Sanity check the root record Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 27/72] fs: fix missing declaration of init_files Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 28/72] kheaders: Ignore silly-rename files Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 29/72] cachefiles: Parse the "secctx" immediately Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 30/72] scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 31/72] selftests: tc-testing: reduce rshift value Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 32/72] ACPI: resource: acpi_dev_irq_override(): Check DMI match last Greg Kroah-Hartman
2025-01-21 17:51 ` [PATCH 6.6 33/72] iomap: avoid avoid truncating 64-bit offset to 32 bits Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 34/72] poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll() Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 35/72] RDMA/bnxt_re: Fix to export port num to ib_query_qp Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 36/72] nvmet: propagate npwg topology Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 37/72] x86/asm: Make serialize() always_inline Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 38/72] ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 39/72] zram: fix potential UAF of zram table Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 40/72] i2c: atr: Fix client detach Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 41/72] mptcp: be sure to send ack when mptcp-level window re-opens Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 42/72] mptcp: fix spurious wake-up on under memory pressure Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 43/72] selftests: mptcp: avoid spurious errors on disconnect Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 44/72] net: ethernet: xgbe: re-add aneg to supported features in PHY quirks Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 45/72] vsock/bpf: return early if transport is not assigned Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 46/72] vsock/virtio: discard packets if the transport changes Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 47/72] vsock/virtio: cancel close work in the destructor Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 48/72] vsock: reset socket state when de-assigning the transport Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 49/72] vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 50/72] nouveau/fence: handle cross device fences properly Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 51/72] filemap: avoid truncating 64-bit offset to 32 bits Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 52/72] fs/proc: fix softlockup in __read_vmcore (part 2) Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 53/72] gpio: xilinx: Convert gpio_lock to raw spinlock Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 54/72] pmdomain: imx8mp-blk-ctrl: add missing loop break condition Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 55/72] irqchip: Plug a OF node reference leak in platform_irqchip_probe() Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 56/72] irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 57/72] irqchip/gic-v3-its: Dont enable interrupts in its_irq_set_vcpu_affinity() Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 58/72] hrtimers: Handle CPU state correctly on hotplug Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 59/72] drm/i915/fb: Relax clear color alignment to 64 bytes Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 60/72] drm/amdgpu: always sync the GFX pipe on ctx switch Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 61/72] Revert "PCI: Use preserve_config in place of pci_flags" Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 62/72] iio: imu: inv_icm42600: fix spi burst write not supported Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 63/72] drm/amd/display: Fix out-of-bounds access in dcn21_link_encoder_create Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 64/72] block: fix uaf for flush rq while iterating tags Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 65/72] ocfs2: fix deadlock in ocfs2_get_system_file_inode Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 66/72] ovl: pass realinode to ovl_encode_real_fh() instead of realdentry Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 67/72] ovl: support encoding fid from inode with no alias Greg Kroah-Hartman
2025-01-21 17:52 ` Greg Kroah-Hartman [this message]
2025-01-21 17:52 ` [PATCH 6.6 69/72] Revert "drm/amdgpu: rework resume handling for display (v2)" Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 70/72] nfsd: add list_head nf_gc to struct nfsd_file Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 71/72] x86/xen: fix SLS mitigation in xen_hypercall_iret() Greg Kroah-Hartman
2025-01-21 17:52 ` [PATCH 6.6 72/72] net: fix data-races around sk->sk_forward_alloc Greg Kroah-Hartman
2025-01-21 18:57 ` [PATCH 6.6 00/72] 6.6.74-rc1 review Florian Fainelli
2025-01-21 20:41 ` Peter Schneider
2025-01-21 23:35 ` Shuah Khan
2025-01-21 23:47 ` SeongJae Park
2025-01-22 9:25 ` Ron Economos
2025-01-22 12:06 ` Naresh Kamboju
2025-01-22 13:23 ` Jon Hunter
2025-01-22 14:41 ` Muhammad Usama Anjum
2025-01-22 17:04 ` Mark Brown
2025-01-22 20:18 ` [PATCH 6.6] " Hardik Garg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250121174526.052498309@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=amir73il@gmail.com \
--cc=brauner@kernel.org \
--cc=dima@arista.com \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
--cc=syzbot+ec07f6f5ce62b858579f@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.