From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C803C001B3 for ; Mon, 19 Jun 2023 10:41:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232037AbjFSKlS (ORCPT ); Mon, 19 Jun 2023 06:41:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46306 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232048AbjFSKk5 (ORCPT ); Mon, 19 Jun 2023 06:40:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C02F1C6 for ; Mon, 19 Jun 2023 03:40:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 566C660B62 for ; Mon, 19 Jun 2023 10:40:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6A016C433C0; Mon, 19 Jun 2023 10:40:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1687171255; bh=vrrwknnOMnp3/fFeIK2dbFuoU8Bp6+uORAd3Be18evg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=b0dTBJFbyGVbjMjTjTwaGGnuvF3ZvIm1JJFyZv290UYiVNNVYNSV4rIDNkymCopT2 eWSoT2b7W7vI6+wpJt2Dt3Q5zOxVCrKp/3lcPaJo6HmIqT33jR3k8s4bCejEgTo145 UkG8q9kshY8iCJ7dndagmh/Ej9IlUsxlwEzxMpCI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Ryusuke Konishi , syzbot+33494cd0df2ec2931851@syzkaller.appspotmail.com, Andrew Morton Subject: [PATCH 4.19 16/49] nilfs2: fix possible out-of-bounds segment allocation in resize ioctl Date: Mon, 19 Jun 2023 12:29:54 +0200 Message-ID: <20230619102130.699910672@linuxfoundation.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230619102129.856988902@linuxfoundation.org> References: <20230619102129.856988902@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Ryusuke Konishi commit fee5eaecca86afa544355569b831c1f90f334b85 upstream. Syzbot reports that in its stress test for resize ioctl, the log writing function nilfs_segctor_do_construct hits a WARN_ON in nilfs_segctor_truncate_segments(). It turned out that there is a problem with the current implementation of the resize ioctl, which changes the writable range on the device (the range of allocatable segments) at the end of the resize process. This order is necessary for file system expansion to avoid corrupting the superblock at trailing edge. However, in the case of a file system shrink, if log writes occur after truncating out-of-bounds trailing segments and before the resize is complete, segments may be allocated from the truncated space. The userspace resize tool was fine as it limits the range of allocatable segments before performing the resize, but it can run into this issue if the resize ioctl is called alone. Fix this issue by changing nilfs_sufile_resize() to update the range of allocatable segments immediately after successful truncation of segment space in case of file system shrink. Link: https://lkml.kernel.org/r/20230524094348.3784-1-konishi.ryusuke@gmail.com Fixes: 4e33f9eab07e ("nilfs2: implement resize ioctl") Signed-off-by: Ryusuke Konishi Reported-by: syzbot+33494cd0df2ec2931851@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/0000000000005434c405fbbafdc5@google.com Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- fs/nilfs2/sufile.c | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/fs/nilfs2/sufile.c +++ b/fs/nilfs2/sufile.c @@ -782,6 +782,15 @@ int nilfs_sufile_resize(struct inode *su goto out_header; sui->ncleansegs -= nsegs - newnsegs; + + /* + * If the sufile is successfully truncated, immediately adjust + * the segment allocation space while locking the semaphore + * "mi_sem" so that nilfs_sufile_alloc() never allocates + * segments in the truncated space. + */ + sui->allocmax = newnsegs - 1; + sui->allocmin = 0; } kaddr = kmap_atomic(header_bh->b_page);