MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-08-21 16:31:14 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
v6.12.41
linux-yocto/fs/ext4
History
Zhang Yi a4d60ba277 ext4: fix out of bounds punch offset 
[ Upstream commit b5e58bcd79 ]

Punching a hole with a start offset that exceeds max_end is not
permitted and will result in a negative length in the
truncate_inode_partial_folio() function while truncating the page cache,
potentially leading to undesirable consequences.

A simple reproducer:

  truncate -s 9895604649994 /mnt/foo
  xfs_io -c "pwrite 8796093022208 4096" /mnt/foo
  xfs_io -c "fpunch 8796093022213 25769803777" /mnt/foo

  kernel BUG at include/linux/highmem.h:275!
  Oops: invalid opcode: 0000 [#1] SMP PTI
  CPU: 3 UID: 0 PID: 710 Comm: xfs_io Not tainted 6.15.0-rc3
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
  RIP: 0010:zero_user_segments.constprop.0+0xd7/0x110
  RSP: 0018:ffffc90001cf3b38 EFLAGS: 00010287
  RAX: 0000000000000005 RBX: ffffea0001485e40 RCX: 0000000000001000
  RDX: 000000000040b000 RSI: 0000000000000005 RDI: 000000000040b000
  RBP: 000000000040affb R08: ffff888000000000 R09: ffffea0000000000
  R10: 0000000000000003 R11: 00000000fffc7fc5 R12: 0000000000000005
  R13: 000000000040affb R14: ffffea0001485e40 R15: ffff888031cd3000
  FS:  00007f4f63d0b780(0000) GS:ffff8880d337d000(0000)
  knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 000000001ae0b038 CR3: 00000000536aa000 CR4: 00000000000006f0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   <TASK>
   truncate_inode_partial_folio+0x3dd/0x620
   truncate_inode_pages_range+0x226/0x720
   ? bdev_getblk+0x52/0x3e0
   ? ext4_get_group_desc+0x78/0x150
   ? crc32c_arch+0xfd/0x180
   ? __ext4_get_inode_loc+0x18c/0x840
   ? ext4_inode_csum+0x117/0x160
   ? jbd2_journal_dirty_metadata+0x61/0x390
   ? __ext4_handle_dirty_metadata+0xa0/0x2b0
   ? kmem_cache_free+0x90/0x5a0
   ? jbd2_journal_stop+0x1d5/0x550
   ? __ext4_journal_stop+0x49/0x100
   truncate_pagecache_range+0x50/0x80
   ext4_truncate_page_cache_block_range+0x57/0x3a0
   ext4_punch_hole+0x1fe/0x670
   ext4_fallocate+0x792/0x17d0
   ? __count_memcg_events+0x175/0x2a0
   vfs_fallocate+0x121/0x560
   ksys_fallocate+0x51/0xc0
   __x64_sys_fallocate+0x24/0x40
   x64_sys_call+0x18d2/0x4170
   do_syscall_64+0xa7/0x220
   entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fix this by filtering out cases where the punching start offset exceeds
max_end.

Fixes: 982bf37da0 ("ext4: refactor ext4_punch_hole()")
Reported-by: Liebes Wang <wanghaichi0403@gmail.com>
Closes: https://lore.kernel.org/linux-ext4/ac3a58f6-e686-488b-a9ee-fc041024e43d@huawei.com/
Tested-by: Liebes Wang <wanghaichi0403@gmail.com>
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Link: https://patch.msgid.link/20250506012009.3896990-1-yi.zhang@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-01 09:48:46 +01:00
..
.kunitconfig
acl.c ext4: convert to ctime accessor functions 2023-07-24 10:29:54 +02:00
acl.h Revert "ext4: apply umask if ACL support is disabled" 2024-05-02 18:25:39 -04:00
balloc.c ext4: reorder capability check last 2025-05-29 11:02:15 +02:00
bitmap.c ext4: move checksum length calculation of inode bitmap into ext4_inode_bitmap_csum_[verify/set]() functions 2024-09-03 22:12:15 -04:00
block_validity.c ext4: make block validity check resistent to sb bh corruption 2025-05-02 07:59:25 +02:00
crypto.c ext4: Move CONFIG_UNICODE defguards into the code flow 2024-06-07 17:00:45 +02:00
dir.c ext4: fix OOB read when checking dotdot dir 2025-04-10 14:39:39 +02:00
ext4_extents.h
ext4_jbd2.c use ->bd_mapping instead of ->bd_inode->i_mapping 2024-05-03 02:36:51 -04:00
ext4_jbd2.h
ext4.h ext4: refactor ext4_punch_hole() 2025-08-01 09:48:45 +01:00
extents_status.c ext4: drop all delonly descriptions 2024-09-02 15:26:15 -04:00
extents_status.h ext4: drop ext4_es_is_delonly() 2024-09-02 15:26:14 -04:00
extents.c ext4: correct the error handle in ext4_fallocate() 2025-08-01 09:48:46 +01:00
fast_commit.c ext4: use handle to mark fc as ineligible in __track_dentry_update() 2024-10-04 17:35:54 -04:00
fast_commit.h
file.c ext4: factor out ext4_get_maxbytes() 2025-06-27 11:11:20 +01:00
fsmap.c ext4: fix FS_IOC_GETFSMAP handling 2024-12-05 14:02:41 +01:00
fsmap.h
fsync.c ext4: drop EXT4_MF_FS_ABORTED flag 2023-07-29 18:37:53 -04:00
hash.c ext4: remove redundant checks of s_encoding 2023-08-27 11:27:13 -04:00
ialloc.c ext4: fix race in buffer_head read fault injection 2024-12-05 14:01:15 +01:00
indirect.c ext4: fix race in buffer_head read fault injection 2024-12-05 14:01:15 +01:00
inline.c ext4: inline: fix len overflow in ext4_prepare_inline_data 2025-06-27 11:11:20 +01:00
inode-test.c ext4: add missing MODULE_DESCRIPTION() 2024-07-05 16:07:24 -04:00
inode.c ext4: fix out of bounds punch offset 2025-08-01 09:48:46 +01:00
ioctl.c introduce fd_file(), convert all accessors to it. 2024-08-12 22:00:43 -04:00
Kconfig fs: add CONFIG_BUFFER_HEAD 2023-08-02 09:13:09 -06:00
Makefile
mballoc-test.c ext4: add test_mb_mark_used_cost to estimate cost of mb_mark_used 2024-05-03 00:12:32 -04:00
mballoc.c fs/ext4: use sleeping version of sb_find_get_block() 2025-05-29 11:02:00 +02:00
mballoc.h ext4: fix FS_IOC_GETFSMAP handling 2024-12-05 14:02:41 +01:00
migrate.c ext4: fix i_data_sem unlock order in ext4_ind_migrate() 2024-09-03 22:14:17 -04:00
mmp.c ext4: fix race in buffer_head read fault injection 2024-12-05 14:01:15 +01:00
move_extent.c ext4: fix race in buffer_head read fault injection 2024-12-05 14:01:15 +01:00
namei.c ext4: fix off-by-one error in do_split 2025-04-20 10:15:42 +02:00
orphan.c
page-io.c ext4: do not convert the unwritten extents if data writeback fails 2025-05-29 11:02:19 +02:00
readpage.c ext4: reduce stack usage in ext4_mpage_readpages() 2024-08-26 21:47:03 -04:00
resize.c ext4: fix race in buffer_head read fault injection 2024-12-05 14:01:15 +01:00
super.c ext4: reject the 'data_err=abort' option in nojournal mode 2025-05-29 11:02:19 +02:00
symlink.c ext4_get_link(): fix breakage in RCU mode 2024-02-25 02:10:32 -05:00
sysfs.c ext4: add positive int attr pointer to avoid sysfs variables overflow 2024-05-02 23:48:30 -04:00
truncate.h
verity.c fs: Convert aops->write_begin to take a folio 2024-08-07 11:33:21 +02:00
xattr_hurd.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr_security.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr_trusted.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr_user.c fs: port xattr to mnt_idmap 2023-01-19 09:24:28 +01:00
xattr.c ext4: ignore xattrs past end 2025-04-20 10:15:20 +02:00
xattr.h ext4: annotate struct ext4_xattr_inode_array with __counted_by() 2024-08-26 23:40:06 -04:00