Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4390C433F5 for ; Sun, 9 Jan 2022 09:36:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234008AbiAIJgr (ORCPT ); Sun, 9 Jan 2022 04:36:47 -0500 Received: from mail.parknet.co.jp ([210.171.160.6]:57434 "EHLO mail.parknet.co.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229523AbiAIJgq (ORCPT ); Sun, 9 Jan 2022 04:36:46 -0500 Received: from ibmpc.myhome.or.jp (server.parknet.ne.jp [210.171.168.39]) by mail.parknet.co.jp (Postfix) with ESMTPSA id A33DE15F93A; Sun, 9 Jan 2022 18:36:45 +0900 (JST) Received: from devron.myhome.or.jp (foobar@devron.myhome.or.jp [192.168.0.3]) by ibmpc.myhome.or.jp (8.16.1/8.16.1/Debian-2) with ESMTPS id 2099ahk9096048 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sun, 9 Jan 2022 18:36:44 +0900 Received: from devron.myhome.or.jp (foobar@localhost [127.0.0.1]) by devron.myhome.or.jp (8.16.1/8.16.1/Debian-2) with ESMTPS id 2099ahfd817108 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Sun, 9 Jan 2022 18:36:43 +0900 Received: (from hirofumi@localhost) by devron.myhome.or.jp (8.16.1/8.16.1/Submit) id 2099ah09817107; Sun, 9 Jan 2022 18:36:43 +0900 From: OGAWA Hirofumi To: linux-block@vger.kernel.org Cc: Jens Axboe , glider@google.com, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, syzbot Subject: [PATCH] block: Fix wrong offset in bio_truncate() References: <000000000000880fca05d4fc73b0@google.com> Date: Sun, 09 Jan 2022 18:36:43 +0900 In-Reply-To: <000000000000880fca05d4fc73b0@google.com> (syzbot's message of "Fri, 07 Jan 2022 03:40:18 -0800") Message-ID: <875yqt1c9g.fsf@mail.parknet.co.jp> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/29.0.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org bio_truncate() clears the buffer outside of last block of bdev, however current bio_truncate() is using the wrong offset of page. So it can return the uninitialized data. This happened when both of truncated/corrupted FS and userspace (via bdev) are trying to read the last of bdev. Reported-by: syzbot+ac94ae5f68b84197f41c@syzkaller.appspotmail.com Signed-off-by: OGAWA Hirofumi --- block/bio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/block/bio.c b/block/bio.c index a6fb6a0..25f1ed2 100644 --- a/block/bio.c 2021-11-01 09:19:05.999472589 +0900 +++ b/block/bio.c 2022-01-09 17:40:09.010438012 +0900 @@ -567,7 +567,8 @@ void bio_truncate(struct bio *bio, unsig offset = new_size - done; else offset = 0; - zero_user(bv.bv_page, offset, bv.bv_len - offset); + zero_user(bv.bv_page, bv.bv_offset + offset, + bv.bv_len - offset); truncated = true; } done += bv.bv_len; _ -- OGAWA Hirofumi