linux/fs/nilfs2
Ryusuke Konishi 679bd7ebdd nilfs2: fix buffer corruption due to concurrent device reads
As a result of analysis of a syzbot report, it turned out that in three
cases where nilfs2 allocates block device buffers directly via sb_getblk,
concurrent reads to the device can corrupt the allocated buffers.

Nilfs2 uses sb_getblk for segment summary blocks, that make up a log
header, and the super root block, that is the trailer, and when moving and
writing the second super block after fs resize.

In any of these, since the uptodate flag is not set when storing metadata
to be written in the allocated buffers, the stored metadata will be
overwritten if a device read of the same block occurs concurrently before
the write.  This causes metadata corruption and misbehavior in the log
write itself, causing warnings in nilfs_btree_assign() as reported.

Fix these issues by setting an uptodate flag on the buffer head on the
first or before modifying each buffer obtained with sb_getblk, and
clearing the flag on failure.

When setting the uptodate flag, the lock_buffer/unlock_buffer pair is used
to perform necessary exclusive control, and the buffer is filled to ensure
that uninitialized bytes are not mixed into the data read from others.  As
for buffers for segment summary blocks, they are filled incrementally, so
if the uptodate flag was unset on their allocation, set the flag and zero
fill the buffer once at that point.

Also, regarding the superblock move routine, the starting point of the
memset call to zerofill the block is incorrectly specified, which can
cause a buffer overflow on file systems with block sizes greater than
4KiB.  In addition, if the superblock is moved within a large block, it is
necessary to assume the possibility that the data in the superblock will
be destroyed by zero-filling before copying.  So fix these potential
issues as well.

Link: https://lkml.kernel.org/r/20230609035732.20426-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+31837fe952932efc8fb9@syzkaller.appspotmail.com
Closes: https://lkml.kernel.org/r/00000000000030000a05e981f475@google.com
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2023-06-19 13:19:33 -07:00
..
alloc.c nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
alloc.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
bmap.c nilfs2: fix infinite loop in nilfs_mdt_get_block() 2023-05-06 10:10:07 -07:00
bmap.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
btnode.c nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() 2023-06-12 11:31:49 -07:00
btnode.h fs/nilfs2: Use the enum req_op and blk_opf_t types 2022-07-14 12:14:33 -06:00
btree.c nilfs2: initialize "struct nilfs_binfo_dat"->bi_pad field 2023-04-05 18:06:23 -07:00
btree.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
cpfile.c nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
cpfile.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
dat.c nilfs2: prevent WARNING in nilfs_dat_commit_end() 2023-02-02 22:50:10 -08:00
dat.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
dir.c nilfs2: Remove check for PageError 2022-06-29 08:51:07 -04:00
direct.c nilfs2: initialize "struct nilfs_binfo_dat"->bi_pad field 2023-04-05 18:06:23 -07:00
direct.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
export.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
file.c nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
gcinode.c nilfs2: replace obvious uses of b_page with b_folio 2023-01-18 17:12:41 -08:00
ifile.c nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
ifile.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
inode.c nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() 2023-05-17 15:24:34 -07:00
ioctl.c nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() 2023-03-23 17:18:32 -07:00
Kconfig fs: build the legacy direct I/O code conditionally 2023-01-26 10:30:56 -07:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mdt.c nilfs2: replace obvious uses of b_page with b_folio 2023-01-18 17:12:41 -08:00
mdt.h nilfs2: fix lockdep warnings during disk space reclamation 2022-04-01 11:46:09 -07:00
namei.c fs: port ->rename() to pass mnt_idmap 2023-01-19 09:24:26 +01:00
nilfs.h fs: port ->permission() to pass mnt_idmap 2023-01-19 09:24:28 +01:00
page.c mm: return an ERR_PTR from __filemap_get_folio 2023-04-05 19:42:42 -07:00
page.h nilfs2: get rid of nilfs_mapping_init() 2022-04-01 11:46:09 -07:00
recovery.c fs: Remove aop flags parameter from block_write_begin() 2022-05-08 14:28:19 -04:00
segbuf.c nilfs2: fix buffer corruption due to concurrent device reads 2023-06-19 13:19:33 -07:00
segbuf.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
segment.c nilfs2: fix buffer corruption due to concurrent device reads 2023-06-19 13:19:33 -07:00
segment.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
sufile.c nilfs2: fix possible out-of-bounds segment allocation in resize ioctl 2023-06-12 11:31:51 -07:00
sufile.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
super.c nilfs2: fix buffer corruption due to concurrent device reads 2023-06-19 13:19:33 -07:00
sysfs.c nilfs2: use default_groups in kobj_type 2021-12-29 10:53:48 +01:00
sysfs.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
the_nilfs.c nilfs2: reject devices with insufficient block count 2023-06-12 11:31:51 -07:00
the_nilfs.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00