Received: by 2002:a05:6a10:af89:0:0:0:0 with SMTP id iu9csp3682785pxb; Mon, 24 Jan 2022 15:15:00 -0800 (PST) X-Google-Smtp-Source: ABdhPJz3juDPDunYNpY2eRLwgxmDvgSlAOAcfkFLO3itjn/d8LZsIQhbKToY0vX+i1e8Md3ZYJoA X-Received: by 2002:a63:595e:: with SMTP id j30mr12288470pgm.487.1643066100156; Mon, 24 Jan 2022 15:15:00 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1643066100; cv=none; d=google.com; s=arc-20160816; b=hnDE54KLup6r2MOJId5Cij+PXKwWtSTSTYDVmQSiHOW5hIR7fE3lMugERM4ptyx+De nDV4uoBoAHuRJSE6JPKFMaZJaEgVSG6M9oAc8b1Jy0Gduvb3TvsIiZNF/CFCqzy1zuX/ wonkRcziEVqbxzikNGwt7FE5XzE2zYmC2c4qlAes9HSwEF3Fus7eLOMHXBFqaWeBJdpA A2OM5TD764+d5iqU6m9JOmlXOHh6aBPrl8WvxszQiG55umKHukwhtq6ZJqElkXGurWix H0/UkXr+5wkqVo3qHjxlLcjr83NZEppjlr9nUjFvaW2xDlTGtGPJYHRRiJl0k0pDqO9j p2Qw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Pe+HCLAwr4upc7GHDzStb2F1JbWgK3tvxAeJ3gNdJBQ=; b=t3JFTe8QzNPP90psfbfAnu/QYtFDN3YCtA/AGB91Btu6DzHEBO9RPcuEoGM/AAoZrY /ug0vrdo1YcuaZvEDIT3gUF2/nVGr7fDawducpDW6pk4sRb5DywYWgghnKpg+PUjCsEH i9LUKsxaHGethI2IVLwAWRXm4m4VsNgdY+OerHKfzBWNmASBvy37tqTBLTcPq3Svh6l9 0WKOt0RpDW6FLGS18e+maAG/pcAh8RAOCcCd5KYfXZLcANuzEbYy6eqNoxThjUf6rXGx 5Ahj2DK1dEcVxUYOCADoKN0uPh8s/C8ddtFiaQsJZytN0mN7w3swIShM8+7FOFlYWGTY vmPw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="cTzKxm/m"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id x8si13618179plv.391.2022.01.24.15.14.48; Mon, 24 Jan 2022 15:15:00 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="cTzKxm/m"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1383508AbiAXXIo (ORCPT + 99 others); Mon, 24 Jan 2022 18:08:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35700 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1583213AbiAXWRZ (ORCPT ); Mon, 24 Jan 2022 17:17:25 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2F5DDC0617BD; Mon, 24 Jan 2022 12:47:50 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EB09EB81057; Mon, 24 Jan 2022 20:47:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58EC3C340E5; Mon, 24 Jan 2022 20:47:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643057267; bh=hXcoNs0eV+dMtxkq6Dw8eNgx0kpJ36Vku3/tBigUjX0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cTzKxm/m3CfJYKP+KOtRTTnFNKYDjP9Z0rgvfWyyoojLwsmVzFrZ6+BZAEddpqLlF ny2E2oHNEJg/KquDhbO3shMxvcNHPipZHThnLKAVPjp46EUtlhdMN0V3scxFI4kN6x m4jVZF9pzt2amOcOsZs+FMdFXt14ZzhY2NqirLDA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Ye Bin , Theodore Tso Subject: [PATCH 5.15 723/846] ext4: fix null-ptr-deref in __ext4_journal_ensure_credits Date: Mon, 24 Jan 2022 19:44:00 +0100 Message-Id: <20220124184125.948399488@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124184100.867127425@linuxfoundation.org> References: <20220124184100.867127425@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Ye Bin commit 298b5c521746d69c07beb2757292fb5ccc1b0f85 upstream. We got issue as follows when run syzkaller test: [ 1901.130043] EXT4-fs error (device vda): ext4_remount:5624: comm syz-executor.5: Abort forced by user [ 1901.130901] Aborting journal on device vda-8. [ 1901.131437] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.16: Detected aborted journal [ 1901.131566] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.11: Detected aborted journal [ 1901.132586] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.18: Detected aborted journal [ 1901.132751] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.9: Detected aborted journal [ 1901.136149] EXT4-fs error (device vda) in ext4_reserve_inode_write:6035: Journal has aborted [ 1901.136837] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-fuzzer: Detected aborted journal [ 1901.136915] ================================================================== [ 1901.138175] BUG: KASAN: null-ptr-deref in __ext4_journal_ensure_credits+0x74/0x140 [ext4] [ 1901.138343] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.13: Detected aborted journal [ 1901.138398] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.1: Detected aborted journal [ 1901.138808] Read of size 8 at addr 0000000000000000 by task syz-executor.17/968 [ 1901.138817] [ 1901.138852] EXT4-fs error (device vda): ext4_journal_check_start:61: comm syz-executor.30: Detected aborted journal [ 1901.144779] CPU: 1 PID: 968 Comm: syz-executor.17 Not tainted 4.19.90-vhulk2111.1.0.h893.eulerosv2r10.aarch64+ #1 [ 1901.146479] Hardware name: linux,dummy-virt (DT) [ 1901.147317] Call trace: [ 1901.147552] dump_backtrace+0x0/0x2d8 [ 1901.147898] show_stack+0x28/0x38 [ 1901.148215] dump_stack+0xec/0x15c [ 1901.148746] kasan_report+0x108/0x338 [ 1901.149207] __asan_load8+0x58/0xb0 [ 1901.149753] __ext4_journal_ensure_credits+0x74/0x140 [ext4] [ 1901.150579] ext4_xattr_delete_inode+0xe4/0x700 [ext4] [ 1901.151316] ext4_evict_inode+0x524/0xba8 [ext4] [ 1901.151985] evict+0x1a4/0x378 [ 1901.152353] iput+0x310/0x428 [ 1901.152733] do_unlinkat+0x260/0x428 [ 1901.153056] __arm64_sys_unlinkat+0x6c/0xc0 [ 1901.153455] el0_svc_common+0xc8/0x320 [ 1901.153799] el0_svc_handler+0xf8/0x160 [ 1901.154265] el0_svc+0x10/0x218 [ 1901.154682] ================================================================== This issue may happens like this: Process1 Process2 ext4_evict_inode ext4_journal_start ext4_truncate ext4_ind_truncate ext4_free_branches ext4_ind_truncate_ensure_credits ext4_journal_ensure_credits_fn ext4_journal_restart handle->h_transaction = NULL; mount -o remount,abort /mnt -> trigger JBD abort start_this_handle -> will return failed ext4_xattr_delete_inode ext4_journal_ensure_credits ext4_journal_ensure_credits_fn __ext4_journal_ensure_credits jbd2_handle_buffer_credits journal = handle->h_transaction->t_journal; ->null-ptr-deref Now, indirect truncate process didn't handle error. To solve this issue maybe simply add check handle is abort in '__ext4_journal_ensure_credits' is enough, and i also think this is necessary. Cc: stable@kernel.org Signed-off-by: Ye Bin Link: https://lore.kernel.org/r/20211224100341.3299128-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman --- fs/ext4/ext4_jbd2.c | 2 ++ 1 file changed, 2 insertions(+) --- a/fs/ext4/ext4_jbd2.c +++ b/fs/ext4/ext4_jbd2.c @@ -162,6 +162,8 @@ int __ext4_journal_ensure_credits(handle { if (!ext4_handle_valid(handle)) return 0; + if (is_handle_aborted(handle)) + return -EROFS; if (jbd2_handle_buffer_credits(handle) >= check_cred && handle->h_revoke_credits >= revoke_cred) return 0;