Andrew Kanner
38cbf13b2e
ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
commit 0b63c0e01fba40e3992bc627272ec7b618ccaef7 upstream.
Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove():
[ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12
[ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry
[ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004
[...]
[ 57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0
[...]
[ 57.331328] Call Trace:
[ 57.331477] <TASK>
[...]
[ 57.333511] ? do_user_addr_fault+0x3e5/0x740
[ 57.333778] ? exc_page_fault+0x70/0x170
[ 57.334016] ? asm_exc_page_fault+0x2b/0x30
[ 57.334263] ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10
[ 57.334596] ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0
[ 57.334913] ocfs2_xa_remove_entry+0x23/0xc0
[ 57.335164] ocfs2_xa_set+0x704/0xcf0
[ 57.335381] ? _raw_spin_unlock+0x1a/0x40
[ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20
[ 57.335915] ? trace_preempt_on+0x1e/0x70
[ 57.336153] ? start_this_handle+0x16c/0x500
[ 57.336410] ? preempt_count_sub+0x50/0x80
[ 57.336656] ? _raw_read_unlock+0x20/0x40
[ 57.336906] ? start_this_handle+0x16c/0x500
[ 57.337162] ocfs2_xattr_block_set+0xa6/0x1e0
[ 57.337424] __ocfs2_xattr_set_handle+0x1fd/0x5d0
[ 57.337706] ? ocfs2_start_trans+0x13d/0x290
[ 57.337971] ocfs2_xattr_set+0xb13/0xfb0
[ 57.338207] ? dput+0x46/0x1c0
[ 57.338393] ocfs2_xattr_trusted_set+0x28/0x30
[ 57.338665] ? ocfs2_xattr_trusted_set+0x28/0x30
[ 57.338948] __vfs_removexattr+0x92/0xc0
[ 57.339182] __vfs_removexattr_locked+0xd5/0x190
[ 57.339456] ? preempt_count_sub+0x50/0x80
[ 57.339705] vfs_removexattr+0x5f/0x100
[...]
Reproducer uses faultinject facility to fail ocfs2_xa_remove() ->
ocfs2_xa_value_truncate() with -ENOMEM.
In this case the comment mentions that we can return 0 if
ocfs2_xa_cleanup_value_truncate() is going to wipe the entry
anyway. But the following 'rc' check is wrong and execution flow do
'ocfs2_xa_remove_entry(loc);' twice:
* 1st: in ocfs2_xa_cleanup_value_truncate();
* 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'.
Fix this by skipping the 2nd removal of the same entry and making
syzkaller repro happy.
Link: https://lkml.kernel.org/r/20241103193845.2940988-1-andrew.kanner@gmail.com
Fixes: 399ff3a748 ("ocfs2: Handle errors while setting external xattr values.")
Signed-off-by: Andrew Kanner <andrew.kanner@gmail.com>
Reported-by: syzbot+386ce9e60fa1b18aac5b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/671e13ab.050a0220.2b8c0f.01d0.GAE@google.com/T/
Tested-by: syzbot+386ce9e60fa1b18aac5b@syzkaller.appspotmail.com
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-17 14:58:07 +01:00
..
2024-05-17 11:42:41 +02:00
2023-02-06 07:49:38 +01:00
2024-02-23 08:12:45 +01:00
2023-09-23 10:48:15 +02:00
2024-11-17 14:58:07 +01:00
2024-03-06 14:35:23 +00:00
2024-11-08 16:19:10 +01:00
2024-01-08 11:27:37 +01:00
2022-03-02 11:38:13 +01:00
2021-09-22 11:47:56 +02:00
2023-09-23 10:47:59 +02:00
2023-09-23 10:48:11 +02:00
2024-06-16 13:23:24 +02:00
2020-12-02 08:48:12 +01:00
2023-09-23 10:48:16 +02:00
2024-11-08 16:19:16 +01:00
2024-11-08 16:19:11 +01:00
2024-11-08 16:19:19 +01:00
2021-09-22 11:48:02 +02:00
2024-09-12 11:02:51 +02:00
2024-09-04 13:13:01 +02:00
2024-08-19 05:32:03 +02:00
2024-08-19 05:31:55 +02:00
2021-06-03 08:38:12 +02:00
2024-04-13 12:50:15 +02:00
2024-11-08 16:19:14 +01:00
2024-07-18 11:39:33 +02:00
2024-11-08 16:19:21 +01:00
2023-09-23 10:47:59 +02:00
2024-11-08 16:19:17 +01:00
2022-04-15 14:15:03 +02:00
2024-11-17 14:58:06 +01:00
2020-12-30 11:26:02 +01:00
2024-11-08 16:19:17 +01:00
2024-11-08 16:19:23 +01:00
2023-09-23 10:47:58 +02:00
2022-06-14 16:59:20 +02:00
2022-11-25 17:40:30 +01:00
2024-11-17 14:58:07 +01:00
2023-08-11 11:45:01 +02:00
2024-07-18 11:39:33 +02:00
2023-12-08 08:43:26 +01:00
2024-11-17 14:58:07 +01:00
2024-02-23 08:12:45 +01:00
2021-10-06 15:31:20 +02:00
2024-09-04 13:13:01 +02:00
2020-10-30 10:38:21 +01:00
2023-09-23 10:47:59 +02:00
2024-09-12 11:02:54 +02:00
2024-05-02 16:17:10 +02:00
2024-04-13 12:50:15 +02:00
2022-09-20 12:26:48 +02:00
2024-04-13 12:50:04 +02:00
2024-11-08 16:19:21 +01:00
2023-08-11 11:45:01 +02:00
2024-04-13 12:50:09 +02:00
2023-09-23 10:48:17 +02:00
2023-01-18 11:30:42 +01:00
2024-09-04 13:13:02 +02:00
2021-10-06 15:31:24 +02:00
2023-01-18 11:30:42 +01:00
2024-09-04 13:13:01 +02:00
2024-01-08 11:27:37 +01:00
2022-11-25 17:40:29 +01:00
2023-01-18 11:30:27 +01:00
2024-02-23 08:12:58 +01:00
2022-06-14 16:59:24 +02:00
2024-07-27 10:33:43 +02:00
2021-04-14 08:22:32 +02:00
2023-09-23 10:47:59 +02:00
2020-10-07 08:00:09 +02:00
2024-08-19 05:32:17 +02:00
2024-11-08 16:19:09 +01:00
2024-03-26 18:22:34 -04:00
2021-12-08 08:50:13 +01:00
2024-09-04 13:12:59 +02:00
2023-05-17 11:13:23 +02:00
2024-11-08 16:19:09 +01:00
2023-11-28 16:46:36 +00:00
2023-01-18 11:30:06 +01:00
2024-09-04 13:13:07 +02:00
2023-01-18 11:30:51 +01:00
2023-09-23 10:47:59 +02:00
2022-05-15 19:41:59 +02:00
2024-07-05 09:00:35 +02:00
2021-08-12 13:19:43 +02:00
2023-01-18 11:30:40 +01:00
2021-04-28 13:16:50 +02:00
2024-03-26 18:22:34 -04:00
2021-07-20 16:16:16 +02:00
2021-12-14 10:18:07 +01:00
2022-10-26 13:19:21 +02:00
2022-04-27 13:39:44 +02:00
2023-05-30 12:42:11 +01:00
2022-02-23 11:58:38 +01:00
2023-12-08 08:43:26 +01:00
2021-09-22 11:48:02 +02:00
2023-01-18 11:30:04 +01:00