* [PATCH] block: Fix wrong offset in bio_truncate() [not found] <000000000000880fca05d4fc73b0@google.com> @ 2022-01-09 9:36 ` OGAWA Hirofumi 2022-01-10 8:00 ` Ming Lei 2022-01-20 13:30 ` Jens Axboe 0 siblings, 2 replies; 4+ messages in thread From: OGAWA Hirofumi @ 2022-01-09 9:36 UTC (permalink / raw) To: linux-block; +Cc: Jens Axboe, glider, linux-kernel, syzkaller-bugs, syzbot bio_truncate() clears the buffer outside of last block of bdev, however current bio_truncate() is using the wrong offset of page. So it can return the uninitialized data. This happened when both of truncated/corrupted FS and userspace (via bdev) are trying to read the last of bdev. Reported-by: syzbot+ac94ae5f68b84197f41c@syzkaller.appspotmail.com Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> --- block/bio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/block/bio.c b/block/bio.c index a6fb6a0..25f1ed2 100644 --- a/block/bio.c 2021-11-01 09:19:05.999472589 +0900 +++ b/block/bio.c 2022-01-09 17:40:09.010438012 +0900 @@ -567,7 +567,8 @@ void bio_truncate(struct bio *bio, unsig offset = new_size - done; else offset = 0; - zero_user(bv.bv_page, offset, bv.bv_len - offset); + zero_user(bv.bv_page, bv.bv_offset + offset, + bv.bv_len - offset); truncated = true; } done += bv.bv_len; _ -- OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] block: Fix wrong offset in bio_truncate() 2022-01-09 9:36 ` [PATCH] block: Fix wrong offset in bio_truncate() OGAWA Hirofumi @ 2022-01-10 8:00 ` Ming Lei 2022-01-20 4:43 ` OGAWA Hirofumi 2022-01-20 13:30 ` Jens Axboe 1 sibling, 1 reply; 4+ messages in thread From: Ming Lei @ 2022-01-10 8:00 UTC (permalink / raw) To: OGAWA Hirofumi Cc: linux-block, Jens Axboe, glider, linux-kernel, syzkaller-bugs, syzbot On Sun, Jan 09, 2022 at 06:36:43PM +0900, OGAWA Hirofumi wrote: > bio_truncate() clears the buffer outside of last block of bdev, however > current bio_truncate() is using the wrong offset of page. So it can > return the uninitialized data. > > This happened when both of truncated/corrupted FS and userspace (via > bdev) are trying to read the last of bdev. > > Reported-by: syzbot+ac94ae5f68b84197f41c@syzkaller.appspotmail.com > Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> > --- > block/bio.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/block/bio.c b/block/bio.c > index a6fb6a0..25f1ed2 100644 > --- a/block/bio.c 2021-11-01 09:19:05.999472589 +0900 > +++ b/block/bio.c 2022-01-09 17:40:09.010438012 +0900 > @@ -567,7 +567,8 @@ void bio_truncate(struct bio *bio, unsig > offset = new_size - done; > else > offset = 0; > - zero_user(bv.bv_page, offset, bv.bv_len - offset); > + zero_user(bv.bv_page, bv.bv_offset + offset, > + bv.bv_len - offset); Looks correct: Reviewed-by: Ming Lei <ming.lei@redhat.com> -- Ming ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] block: Fix wrong offset in bio_truncate() 2022-01-10 8:00 ` Ming Lei @ 2022-01-20 4:43 ` OGAWA Hirofumi 0 siblings, 0 replies; 4+ messages in thread From: OGAWA Hirofumi @ 2022-01-20 4:43 UTC (permalink / raw) To: Ming Lei Cc: linux-block, Jens Axboe, glider, linux-kernel, syzkaller-bugs, syzbot Ming Lei <ming.lei@redhat.com> writes: > On Sun, Jan 09, 2022 at 06:36:43PM +0900, OGAWA Hirofumi wrote: >> bio_truncate() clears the buffer outside of last block of bdev, however >> current bio_truncate() is using the wrong offset of page. So it can >> return the uninitialized data. >> >> This happened when both of truncated/corrupted FS and userspace (via >> bdev) are trying to read the last of bdev. >> >> Reported-by: syzbot+ac94ae5f68b84197f41c@syzkaller.appspotmail.com >> Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> >> --- >> block/bio.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/block/bio.c b/block/bio.c >> index a6fb6a0..25f1ed2 100644 >> --- a/block/bio.c 2021-11-01 09:19:05.999472589 +0900 >> +++ b/block/bio.c 2022-01-09 17:40:09.010438012 +0900 >> @@ -567,7 +567,8 @@ void bio_truncate(struct bio *bio, unsig >> offset = new_size - done; >> else >> offset = 0; >> - zero_user(bv.bv_page, offset, bv.bv_len - offset); >> + zero_user(bv.bv_page, bv.bv_offset + offset, >> + bv.bv_len - offset); > > Looks correct: > > Reviewed-by: Ming Lei <ming.lei@redhat.com> ping? -- OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] block: Fix wrong offset in bio_truncate() 2022-01-09 9:36 ` [PATCH] block: Fix wrong offset in bio_truncate() OGAWA Hirofumi 2022-01-10 8:00 ` Ming Lei @ 2022-01-20 13:30 ` Jens Axboe 1 sibling, 0 replies; 4+ messages in thread From: Jens Axboe @ 2022-01-20 13:30 UTC (permalink / raw) To: OGAWA Hirofumi, linux-block; +Cc: syzbot, glider, linux-kernel, syzkaller-bugs On Sun, 09 Jan 2022 18:36:43 +0900, OGAWA Hirofumi wrote: > bio_truncate() clears the buffer outside of last block of bdev, however > current bio_truncate() is using the wrong offset of page. So it can > return the uninitialized data. > > This happened when both of truncated/corrupted FS and userspace (via > bdev) are trying to read the last of bdev. > > [...] Applied, thanks! [1/1] block: Fix wrong offset in bio_truncate() commit: 3ee859e384d453d6ac68bfd5971f630d9fa46ad3 Best regards, -- Jens Axboe ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-01-20 13:30 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <000000000000880fca05d4fc73b0@google.com>
2022-01-09 9:36 ` [PATCH] block: Fix wrong offset in bio_truncate() OGAWA Hirofumi
2022-01-10 8:00 ` Ming Lei
2022-01-20 4:43 ` OGAWA Hirofumi
2022-01-20 13:30 ` Jens Axboe
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox