Qu Wenruo a7299a18a1 btrfs: fix u32 overflows when left shifting stripe_nr ... [BUG] David reported an ASSERT() get triggered during fio load on 8 devices with data/raid6 and metadata/raid1c3: fio --rw=randrw --randrepeat=1 --size=3000m \ --bsrange=512b-64k --bs_unaligned \ --ioengine=libaio --fsync=1024 \ --name=job0 --name=job1 \ The ASSERT() is from rbio_add_bio() of raid56.c: ASSERT(orig_logical >= full_stripe_start && orig_logical + orig_len <= full_stripe_start + rbio->nr_data * BTRFS_STRIPE_LEN); Which is checking if the target rbio is crossing the full stripe boundary. [100.789] assertion failed: orig_logical >= full_stripe_start && orig_logical + orig_len <= full_stripe_start + rbio->nr_data * BTRFS_STRIPE_LEN, in fs/btrfs/raid56.c:1622 [100.795] ------------[ cut here ]------------ [100.796] kernel BUG at fs/btrfs/raid56.c:1622! [100.797] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [100.798] CPU: 1 PID: 100 Comm: kworker/u8:4 Not tainted 6.4.0-rc6-default+ #124 [100.799] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014 [100.802] Workqueue: writeback wb_workfn (flush-btrfs-1) [100.803] RIP: 0010:rbio_add_bio+0x204/0x210 [btrfs] [100.806] RSP: 0018:ffff888104a8f300 EFLAGS: 00010246 [100.808] RAX: 00000000000000a1 RBX: ffff8881075907e0 RCX: ffffed1020951e01 [100.809] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000001 [100.811] RBP: 0000000141d20000 R08: 0000000000000001 R09: ffff888104a8f04f [100.813] R10: ffffed1020951e09 R11: 0000000000000003 R12: ffff88810e87f400 [100.815] R13: 0000000041d20000 R14: 0000000144529000 R15: ffff888101524000 [100.817] FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 [100.821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [100.822] CR2: 000055d54e44c270 CR3: 000000010a9a1006 CR4: 00000000003706a0 [100.824] Call Trace: [100.825] <TASK> [100.825] ? die+0x32/0x80 [100.826] ? do_trap+0x12d/0x160 [100.827] ? rbio_add_bio+0x204/0x210 [btrfs] [100.827] ? rbio_add_bio+0x204/0x210 [btrfs] [100.829] ? do_error_trap+0x90/0x130 [100.830] ? rbio_add_bio+0x204/0x210 [btrfs] [100.831] ? handle_invalid_op+0x2c/0x30 [100.833] ? rbio_add_bio+0x204/0x210 [btrfs] [100.835] ? exc_invalid_op+0x29/0x40 [100.836] ? asm_exc_invalid_op+0x16/0x20 [100.837] ? rbio_add_bio+0x204/0x210 [btrfs] [100.837] raid56_parity_write+0x64/0x270 [btrfs] [100.838] btrfs_submit_chunk+0x26e/0x800 [btrfs] [100.840] ? btrfs_bio_init+0x80/0x80 [btrfs] [100.841] ? release_pages+0x503/0x6d0 [100.842] ? folio_unlock+0x2f/0x60 [100.844] ? __folio_put+0x60/0x60 [100.845] ? btrfs_do_readpage+0xae0/0xae0 [btrfs] [100.847] btrfs_submit_bio+0x21/0x60 [btrfs] [100.847] submit_one_bio+0x6a/0xb0 [btrfs] [100.849] extent_write_cache_pages+0x395/0x680 [btrfs] [100.850] ? __extent_writepage+0x520/0x520 [btrfs] [100.851] ? mark_usage+0x190/0x190 [100.852] extent_writepages+0xdb/0x130 [btrfs] [100.853] ? extent_write_locked_range+0x480/0x480 [btrfs] [100.854] ? mark_usage+0x190/0x190 [100.854] ? attach_extent_buffer_page+0x220/0x220 [btrfs] [100.855] ? reacquire_held_locks+0x178/0x280 [100.856] ? writeback_sb_inodes+0x245/0x7f0 [100.857] do_writepages+0x102/0x2e0 [100.858] ? page_writeback_cpu_online+0x10/0x10 [100.859] ? __lock_release.isra.0+0x14a/0x4d0 [100.860] ? reacquire_held_locks+0x280/0x280 [100.861] ? __lock_acquired+0x1e9/0x3d0 [100.862] ? do_raw_spin_lock+0x1b0/0x1b0 [100.863] __writeback_single_inode+0x94/0x450 [100.864] writeback_sb_inodes+0x372/0x7f0 [100.864] ? lock_sync+0xd0/0xd0 [100.865] ? do_raw_spin_unlock+0x93/0xf0 [100.866] ? sync_inode_metadata+0xc0/0xc0 [100.867] ? rwsem_optimistic_spin+0x340/0x340 [100.868] __writeback_inodes_wb+0x70/0x130 [100.869] wb_writeback+0x2d1/0x530 [100.869] ? __writeback_inodes_wb+0x130/0x130 [100.870] ? lockdep_hardirqs_on_prepare.part.0+0xf1/0x1c0 [100.870] wb_do_writeback+0x3eb/0x480 [100.871] ? wb_writeback+0x530/0x530 [100.871] ? mark_lock_irq+0xcd0/0xcd0 [100.872] wb_workfn+0xe0/0x3f0< [CAUSE] Commit a97699d1d6 ("btrfs: replace map_lookup->stripe_len by BTRFS_STRIPE_LEN") changes how we calculate the map length, to reduce u64 division. Function btrfs_max_io_len() is to get the length to the stripe boundary. It calculates the full stripe start offset (inside the chunk) by the following code: *full_stripe_start = rounddown(*stripe_nr, nr_data_stripes(map)) << BTRFS_STRIPE_LEN_SHIFT; The calculation itself is fine, but the value returned by rounddown() is dependent on both @stripe_nr (which is u32) and nr_data_stripes() (which returned int). Thus the result is also u32, then we do the left shift, which can overflow u32. If such overflow happens, @full_stripe_start will be a value way smaller than @offset, causing later "full_stripe_len - (offset - *full_stripe_start)" to underflow, thus make later length calculation to have no stripe boundary limit, resulting a write bio to exceed stripe boundary. There are some other locations like this, with a u32 @stripe_nr got left shift, which can lead to a similar overflow. [FIX] Fix all @stripe_nr with left shift with a type cast to u64 before the left shift. Those involved @stripe_nr or similar variables are recording the stripe number inside the chunk, which is small enough to be contained by u32, but their offset inside the chunk can not fit into u32. Thus for those specific left shifts, a type cast to u64 is necessary so this patch does not touch them and the code will be cleaned up in the future to keep the fix minimal. Reported-by: David Sterba <dsterba@suse.com> Fixes: a97699d1d6 ("btrfs: replace map_lookup->stripe_len by BTRFS_STRIPE_LEN") Tested-by: David Sterba <dsterba@suse.com> Signed-off-by: Qu Wenruo <wqu@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>		2023-06-20 19:10:31 +02:00
..
9p	9P FS: Fix wild-memory-access write in v9fs_get_acl	2023-03-27 00:34:16 +00:00
adfs	fs: port ->setattr() to pass mnt_idmap	2023-01-19 09:24:02 +01:00
affs	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
afs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
autofs	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
befs	befs: Convert befs_symlink_read_folio() to use a folio	2022-08-02 12:34:03 -04:00
bfs	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
btrfs	btrfs: fix u32 overflows when left shifting stripe_nr	2023-06-20 19:10:31 +02:00
cachefiles	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
ceph	Two small fixes from Xiubo and myself, marked for stable.	2023-03-02 10:48:30 -08:00
cifs	cifs: fix negotiate context parsing	2023-04-15 18:26:56 -05:00
coda	hardening updates for v6.3-rc1	2023-02-21 11:07:23 -08:00
configfs	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
cramfs	fs/cramfs/inode.c: initialize file_ra_state	2023-03-02 21:54:23 -08:00
crypto	fscrypt: check for NULL keyring in fscrypt_put_master_key_activeref()	2023-03-18 21:08:03 -07:00
debugfs	ARM: SoC drivers for 6.3	2023-02-27 10:04:49 -08:00
devpts
dlm	Driver core changes for 6.3-rc1	2023-02-24 12:58:55 -08:00
ecryptfs	This update includes the following changes:	2023-02-21 18:10:50 -08:00
efivarfs	A healthy mix of EFI contributions this time:	2023-02-23 14:41:48 -08:00
efs
erofs	erofs: use wrapper i_blocksize() in erofs_file_read_iter()	2023-03-09 23:36:04 +08:00
exfat	Description for this pull request:	2023-03-01 08:42:27 -08:00
exportfs	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
ext2	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
ext4	ext4: fix possible double unlock when moving a directory	2023-03-17 21:53:52 -04:00
f2fs	f2fs-for-6.3-rc1	2023-02-27 16:18:51 -08:00
fat	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
freevxfs	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
fscache	fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work()	2023-01-30 12:51:54 +00:00
fuse	fuse update for 6.3	2023-02-27 09:53:58 -08:00
gfs2	Reinstate "GFS2: free disk inode which is deleted by remote node -V2"	2023-03-23 19:37:56 +01:00
hfs	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
hfsplus	fs: hfsplus: fix UAF issue in hfsplus_put_super	2023-03-02 21:54:23 -08:00
hostfs	This pull request contains the following changes for UML:	2023-03-01 09:13:00 -08:00
hpfs	fs: port ->rename() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
hugetlbfs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
iomap	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
isofs	- hfs and hfsplus kmap API modernization from Fabio Francesco	2022-10-12 11:00:22 -07:00
jbd2	Bug fixes and regressions for ext4, the most serious of which is a	2023-03-12 08:55:55 -07:00
jffs2	This pull request contains updates for JFFS2, UBI and UBIFS	2023-03-01 09:06:51 -08:00
jfs	Just one simple sanity check	2023-03-01 08:47:19 -08:00
kernfs	Driver core changes for 6.3-rc1	2023-02-24 12:58:55 -08:00
ksmbd	ksmbd: avoid out of bounds access in decode_preauth_ctxt()	2023-04-13 14:17:32 -05:00
lockd	lockd: set file_lock start and end when decoding nlm4 testargs	2023-03-14 14:00:55 -04:00
minix	Merge branch 'work.minix' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2023-02-24 19:01:15 -08:00
netfs	netfs: Fix netfs_extract_iter_to_sg() for ITER_UBUF/IOVEC	2023-04-12 09:26:36 -07:00
nfs	nfsd-6.3 fixes:	2023-04-04 11:20:55 -07:00
nfs_common	filelock: move file locking definitions to separate header file	2023-01-11 06:52:32 -05:00
nfsd	nfsd-6.3 fixes:	2023-04-04 11:20:55 -07:00
nilfs2	nilfs2: fix sysfs interface lifetime	2023-04-05 18:06:24 -07:00
nls
notify	RCU pull request for v6.3	2023-02-21 10:45:51 -08:00
ntfs	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
ntfs3	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
ocfs2	ocfs2: fix data corruption after failed write	2023-03-07 17:04:55 -08:00
omfs	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
openpromfs
orangefs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
overlayfs	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
proc	capability: just use a 'u64' instead of a 'u32[2]' array	2023-03-01 10:01:22 -08:00
pstore	pstore updates for v6.2-rc1-fixes	2022-12-23 11:55:54 -08:00
qnx4
qnx6	fs/qnx6: delete unnecessary checks before brelse()	2022-09-11 21:55:07 -07:00
quota	RCU pull request for v6.3	2023-02-21 10:45:51 -08:00
ramfs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
reiserfs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
romfs	mm/nommu: factor out check for NOMMU shared mappings into is_nommu_shared_mapping()	2023-01-18 17:12:56 -08:00
smbfs_common	smb3: Replace smb2pdu 1-element arrays with flex-arrays	2023-02-20 17:25:43 -06:00
squashfs	revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"	2023-02-03 17:52:25 -08:00
sysfs
sysv	Merge branch 'work.sysv' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2023-02-24 19:03:26 -08:00
tracefs	fs: port ->mkdir() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
ubifs	This pull request contains updates for JFFS2, UBI and UBIFS	2023-03-01 09:06:51 -08:00
udf	udf: Warn if block mapping is done for in-ICB files	2023-03-06 16:38:25 +01:00
ufs	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
unicode
vboxsf	fs: port ->rename() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
verity	fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY	2023-03-15 22:50:41 -07:00
xfs	xfs: fix mismerged tracepoints	2023-03-24 13:16:01 -07:00
zonefs	zonefs: Do not propagate iomap_dio_rw() ENOTBLK error to user space	2023-03-30 20:56:02 +09:00
aio.c	Merge branch 'mm-hotfixes-stable' into mm-stable	2023-02-10 15:34:48 -08:00
anon_inodes.c	dynamic_dname(): drop unused dentry argument	2022-08-20 11:34:04 -04:00
attr.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
bad_inode.c	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
binfmt_elf_fdpic.c	elfcore: Add a cprm parameter to elf_core_extra_{phdrs,data_size}	2023-01-05 15:12:12 +00:00
binfmt_elf_test.c
binfmt_elf.c	Linux 6.2-rc6	2023-01-31 15:01:20 +01:00
binfmt_flat.c
binfmt_misc.c	binfmt_misc: fix shift-out-of-bounds in check_special_flags	2022-12-02 13:57:04 -08:00
binfmt_script.c
buffer.c	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
char_dev.c	chardev: fix error handling in cdev_device_add()	2022-12-02 17:48:59 +01:00
compat_binfmt_elf.c
coredump.c	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
d_path.c	d_path.c: typo fix...	2022-08-20 11:34:33 -04:00
dax.c	fsdax: force clear dirty mark if CoW	2023-04-05 18:06:23 -07:00
dcache.c	tmpfile API change	2022-10-10 19:45:17 -07:00
direct-io.c	fs: move sb_init_dio_done_wq out of direct-io.c	2023-01-26 10:30:56 -07:00
drop_caches.c
eventfd.c	eventfd: provide a eventfd_signal_mask() helper	2022-11-22 06:07:55 -07:00
eventpoll.c	eventpoll: add EPOLL_URING_WAKE poll wakeup flag	2022-11-21 07:45:29 -07:00
exec.c	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
fcntl.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
fhandle.c	do_sys_name_to_handle(): constify path	2022-09-01 17:36:39 -04:00
file_table.c	filelock: move file locking definitions to separate header file	2023-01-11 06:52:32 -05:00
file.c	fs: prevent out-of-bounds array speculation when closing a file descriptor	2023-03-09 22:46:21 -05:00
filesystems.c
fs_context.c
fs_parser.c	ext4: journal_path mount options should follow links	2022-12-01 10:46:54 -05:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	mm: convert mem_cgroup_css_from_page() to mem_cgroup_css_from_folio()	2023-02-02 22:33:19 -08:00
fsopen.c
init.c	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
inode.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
internal.h	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
ioctl.c	fs: port inode_owner_or_capable() to mnt_idmap	2023-01-19 09:24:29 +01:00
Kconfig	fs: build the legacy direct I/O code conditionally	2023-01-26 10:30:56 -07:00
Kconfig.binfmt	Xtensa updates for v6.1	2022-10-10 14:21:11 -07:00
kernel_read_file.c
libfs.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
locks.c	filelocks: use mount idmapping for setlease permission check	2023-03-09 22:36:12 +01:00
Makefile	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
mbcache.c	ext4: fix deadlock due to mbcache entry corruption	2022-12-08 21:49:25 -05:00
mnt_idmapping.c	fs: move mnt_idmap	2023-01-19 09:24:30 +01:00
mount.h
mpage.c	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
namei.c	NFSD 6.3 Release Notes	2023-02-22 14:21:40 -08:00
namespace.c	fs: drop peer group ids under namespace lock	2023-03-31 12:13:37 +02:00
no-block.c
nsfs.c	nsfs: repair kernel-doc for ns_match()	2023-01-11 15:47:40 -05:00
open.c	vfs: avoid duplicating creds in faccessat if possible	2023-02-27 16:39:19 -08:00
pipe.c	dynamic_dname(): drop unused dentry argument	2022-08-20 11:34:04 -04:00
pnode.c	pnode: terminate at peers of source	2022-12-21 14:45:25 +01:00
pnode.h
posix_acl.c	fs.acl.v6.3	2023-02-20 12:14:33 -08:00
proc_namespace.c
read_write.c	iov_iter work; most of that is about getting rid of	2022-12-12 18:29:54 -08:00
readdir.c	Change calling conventions for filldir_t	2022-08-17 17:25:04 -04:00
remap_range.c	fs: port i_{g,u}id_into_vfs{g,u}id() to mnt_idmap	2023-01-19 09:24:29 +01:00
select.c
seq_file.c	use less confusing names for iov_iter direction initializers	2022-11-25 13:01:55 -05:00
signalfd.c
splice.c	splice: Remove redundant assignment to ret	2023-03-09 10:10:31 +01:00
stack.c
stat.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
statfs.c
super.c	fscrypt: destroy keyring after security_sb_delete()	2023-03-14 10:30:30 -07:00
sync.c
sysctls.c
timerfd.c
userfaultfd.c	mm: replace vma->vm_flags direct modifications with modifier calls	2023-02-09 16:51:39 -08:00
utimes.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
xattr.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00