Chao Yu fffb6581a2 f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() ... commit 5598b24efaf4892741c798b425d543e4bed357a1 upstream. As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215235 - Overview page fault in f2fs_setxattr() when mount and operate on corrupted image - Reproduce tested on kernel 5.16-rc3, 5.15.X under root 1. unzip tmp7.zip 2. ./single.sh f2fs 7 Sometimes need to run the script several times - Kernel dump loop0: detected capacity change from 0 to 131072 F2FS-fs (loop0): Found nat_bits in checkpoint F2FS-fs (loop0): Mounted with checkpoint version = 7548c2ee BUG: unable to handle page fault for address: ffffe47bc7123f48 RIP: 0010:kfree+0x66/0x320 Call Trace: __f2fs_setxattr+0x2aa/0xc00 [f2fs] f2fs_setxattr+0xfa/0x480 [f2fs] __f2fs_set_acl+0x19b/0x330 [f2fs] __vfs_removexattr+0x52/0x70 __vfs_removexattr_locked+0xb1/0x140 vfs_removexattr+0x56/0x100 removexattr+0x57/0x80 path_removexattr+0xa3/0xc0 __x64_sys_removexattr+0x17/0x20 do_syscall_64+0x37/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is in __f2fs_setxattr(), we missed to do sanity check on last xattr entry, result in out-of-bound memory access during updating inconsistent xattr data of target inode. After the fix, it can detect such xattr inconsistency as below: F2FS-fs (loop11): inode (7) has invalid last xattr entry, entry_size: 60676 F2FS-fs (loop11): inode (8) has corrupted xattr F2FS-fs (loop11): inode (8) has corrupted xattr F2FS-fs (loop11): inode (8) has invalid last xattr entry, entry_size: 47736 Cc: stable@vger.kernel.org Reported-by: Wenqing Liu <wenqingliu0120@gmail.com> Signed-off-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-12-29 12:26:05 +01:00
..
acl.c
acl.h
checkpoint.c
compress.c	f2fs: deallocate compressed pages when error happens	2021-09-18 13:40:16 +02:00
data.c	f2fs: should put a page beyond EOF when preparing a write	2021-09-18 13:40:16 +02:00
debug.c
dir.c	f2fs: reduce the scope of setting fsck tag when de->name_len is zero	2021-09-18 13:40:13 +02:00
extent_cache.c
f2fs.h	f2fs: compress: disallow disabling compress on non-empty compressed file	2021-11-26 10:39:12 +01:00
file.c	f2fs: fix to unmap pages from userspace process in punch_hole()	2021-09-18 13:40:16 +02:00
gc.c	f2fs: fix to account missing .skipped_gc_rwsem	2021-09-18 13:40:16 +02:00
gc.h
hash.c
inline.c
inode.c	f2fs: should use GFP_NOFS for directory inodes	2021-11-18 14:04:29 +01:00
Kconfig
Makefile
namei.c	f2fs: should use GFP_NOFS for directory inodes	2021-11-18 14:04:29 +01:00
node.c	f2fs: set SBI_NEED_FSCK flag when inconsistent node block found	2021-12-01 09:19:08 +01:00
node.h
recovery.c	f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances	2021-07-19 09:45:03 +02:00
segment.c
segment.h
shrinker.c
super.c	f2fs: fix incorrect return value in f2fs_sanity_check_ckpt()	2021-11-26 10:39:12 +01:00
sysfs.c	f2fs: Show casefolding support only when supported	2021-07-25 14:36:17 +02:00
trace.c
trace.h
verity.c
xattr.c	f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()	2021-12-29 12:26:05 +01:00
xattr.h