From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Dehe Gu <gudehe@huawei.com>,
Daiyue Zhang <zhangdaiyue1@huawei.com>,
Chao Yu <yuchao0@huawei.com>, Jaegeuk Kim <jaegeuk@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-f2fs-devel@lists.sourceforge.net
Subject: [PATCH AUTOSEL 5.7 34/61] f2fs: remove write attribute of main_blkaddr sysfs node
Date: Fri, 21 Aug 2020 12:15:18 -0400 [thread overview]
Message-ID: <20200821161545.347622-34-sashal@kernel.org> (raw)
In-Reply-To: <20200821161545.347622-1-sashal@kernel.org>
From: Dehe Gu <gudehe@huawei.com>
[ Upstream commit ffcde4b29a5f20ddca6fe559b48f345818bf1d91 ]
Fuzzing main_blkaddr sysfs node will corrupt this field's value,
causing kernel panic, remove its write attribute to avoid potential
security risk.
[Chao Yu: add description]
Signed-off-by: Dehe Gu <gudehe@huawei.com>
Signed-off-by: Daiyue Zhang <zhangdaiyue1@huawei.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/sysfs.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
index e3bbbef9b4f09..66e8b243e48eb 100644
--- a/fs/f2fs/sysfs.c
+++ b/fs/f2fs/sysfs.c
@@ -222,6 +222,13 @@ static ssize_t avg_vblocks_show(struct f2fs_attr *a,
}
#endif
+static ssize_t main_blkaddr_show(struct f2fs_attr *a,
+ struct f2fs_sb_info *sbi, char *buf)
+{
+ return snprintf(buf, PAGE_SIZE, "%llu\n",
+ (unsigned long long)MAIN_BLKADDR(sbi));
+}
+
static ssize_t f2fs_sbi_show(struct f2fs_attr *a,
struct f2fs_sb_info *sbi, char *buf)
{
@@ -511,7 +518,6 @@ F2FS_RW_ATTR(GC_THREAD, f2fs_gc_kthread, gc_no_gc_sleep_time, no_gc_sleep_time);
F2FS_RW_ATTR(F2FS_SBI, f2fs_sb_info, gc_idle, gc_mode);
F2FS_RW_ATTR(F2FS_SBI, f2fs_sb_info, gc_urgent, gc_mode);
F2FS_RW_ATTR(SM_INFO, f2fs_sm_info, reclaim_segments, rec_prefree_segments);
-F2FS_RW_ATTR(SM_INFO, f2fs_sm_info, main_blkaddr, main_blkaddr);
F2FS_RW_ATTR(DCC_INFO, discard_cmd_control, max_small_discards, max_discards);
F2FS_RW_ATTR(DCC_INFO, discard_cmd_control, discard_granularity, discard_granularity);
F2FS_RW_ATTR(RESERVED_BLOCKS, f2fs_sb_info, reserved_blocks, reserved_blocks);
@@ -551,6 +557,7 @@ F2FS_GENERAL_RO_ATTR(current_reserved_blocks);
F2FS_GENERAL_RO_ATTR(unusable);
F2FS_GENERAL_RO_ATTR(encoding);
F2FS_GENERAL_RO_ATTR(mounted_time_sec);
+F2FS_GENERAL_RO_ATTR(main_blkaddr);
#ifdef CONFIG_F2FS_STAT_FS
F2FS_STAT_ATTR(STAT_INFO, f2fs_stat_info, cp_foreground_calls, cp_count);
F2FS_STAT_ATTR(STAT_INFO, f2fs_stat_info, cp_background_calls, bg_cp_count);
--
2.25.1
next prev parent reply other threads:[~2020-08-21 17:19 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-21 16:14 [PATCH AUTOSEL 5.7 01/61] ALSA: hda/hdmi: Add quirk to force connectivity Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 02/61] ALSA: pci: delete repeated words in comments Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 03/61] ALSA: hda/realtek: Fix pin default on Intel NUC 8 Rugged Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 04/61] ALSA: hda/hdmi: Use force connectivity quirk on another HP desktop Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 05/61] drm/amdgpu: fix RAS memory leak in error case Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 06/61] EDAC/mc: Call edac_inc_ue_error() before panic Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 07/61] ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 08/61] ASoC: img-parallel-out: Fix a reference count leak Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 09/61] ASoC: tegra: Fix reference count leaks Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 10/61] mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 11/61] arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 12/61] powerpc/xive: Ignore kmemleak false positives Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 13/61] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq() Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 14/61] gcc-plugins/stackleak: Don't instrument itself Sasha Levin
2020-08-21 16:14 ` [PATCH AUTOSEL 5.7 15/61] blktrace: ensure our debugfs dir exists Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 16/61] staging: rts5208: fix memleaks on error handling paths in probe Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 17/61] scsi: target: tcmu: Fix crash on ARM during cmd completion Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 18/61] mfd: intel-lpss: Add Intel Tiger Lake PCH-H PCI IDs Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 19/61] iommu/iova: Don't BUG on invalid PFNs Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 20/61] platform/chrome: cros_ec_sensorhub: Fix EC timestamp overflow Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 21/61] drm/amdkfd: Fix reference count leaks Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 22/61] drm/radeon: fix multiple reference count leak Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 23/61] drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 24/61] drm/amd/display: fix ref count leak in amdgpu_drm_ioctl Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 25/61] drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 26/61] drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 27/61] drm/amdgpu/fence: " Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 28/61] drm/amdkfd: " Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 29/61] drm/amdgpu/pm: " Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 30/61] scsi: lpfc: Fix shost refcount mismatch when deleting vport Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 31/61] xfs: Don't allow logging of XFS_ISTALE inodes Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 32/61] scsi: target: Fix xcopy sess release leak Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 33/61] selftests/powerpc: Purge extra count_pmc() calls of ebb selftests Sasha Levin
2020-08-21 16:15 ` Sasha Levin [this message]
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 35/61] f2fs: fix error path in do_recover_data() Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 36/61] omapfb: fix multiple reference count leaks due to pm_runtime_get_sync Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 37/61] PCI: Fix pci_create_slot() reference count leak Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 38/61] ARM: dts: ls1021a: output PPS signal on FIPER2 Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 39/61] rtlwifi: rtl8192cu: Prevent leaking urb Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 40/61] mips/vdso: Fix resource leaks in genvdso.c Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 41/61] ALSA: hda: Add support for Loongson 7A1000 controller Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 42/61] gpu: host1x: Put gather's BO on pinning error Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 43/61] cec-api: prevent leaking memory through hole in structure Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 44/61] ASoC: Intel: sof_sdw_rt711: remove properties in card remove Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 45/61] HID: quirks: add NOGET quirk for Logitech GROUP Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 46/61] f2fs: fix use-after-free issue Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 47/61] drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 48/61] drm/nouveau: fix reference count leak in nv50_disp_atomic_commit Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 49/61] drm/nouveau: Fix reference count leak in nouveau_connector_detect Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 50/61] locking/lockdep: Fix overflow in presentation of average lock-time Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 51/61] btrfs: file: reserve qgroup space after the hole punch range is locked Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 52/61] btrfs: make btrfs_qgroup_check_reserved_leak take btrfs_inode Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 53/61] scsi: iscsi: Do not put host in iscsi_set_flashnode_param() Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 54/61] RDMA/efa: Add EFA 0xefa1 PCI ID Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 55/61] netfilter: nf_tables: report EEXIST on overlaps Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 56/61] ceph: fix potential mdsc use-after-free crash Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 57/61] ceph: do not access the kiocb after aio requests Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 58/61] scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 59/61] i2c: i801: Add support for Intel Tiger Lake PCH-H Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 60/61] EDAC/ie31200: Fallback if host bridge device is already initialized Sasha Levin
2020-08-21 16:15 ` [PATCH AUTOSEL 5.7 61/61] hugetlbfs: prevent filesystem stacking of hugetlbfs Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200821161545.347622-34-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=gudehe@huawei.com \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yuchao0@huawei.com \
--cc=zhangdaiyue1@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox