Andrew Kanner 0b63c0e01f ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() ... Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(): [ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry [ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [ 57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [ 57.331328] Call Trace: [ 57.331477] <TASK> [...] [ 57.333511] ? do_user_addr_fault+0x3e5/0x740 [ 57.333778] ? exc_page_fault+0x70/0x170 [ 57.334016] ? asm_exc_page_fault+0x2b/0x30 [ 57.334263] ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [ 57.334596] ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [ 57.334913] ocfs2_xa_remove_entry+0x23/0xc0 [ 57.335164] ocfs2_xa_set+0x704/0xcf0 [ 57.335381] ? _raw_spin_unlock+0x1a/0x40 [ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20 [ 57.335915] ? trace_preempt_on+0x1e/0x70 [ 57.336153] ? start_this_handle+0x16c/0x500 [ 57.336410] ? preempt_count_sub+0x50/0x80 [ 57.336656] ? _raw_read_unlock+0x20/0x40 [ 57.336906] ? start_this_handle+0x16c/0x500 [ 57.337162] ocfs2_xattr_block_set+0xa6/0x1e0 [ 57.337424] __ocfs2_xattr_set_handle+0x1fd/0x5d0 [ 57.337706] ? ocfs2_start_trans+0x13d/0x290 [ 57.337971] ocfs2_xattr_set+0xb13/0xfb0 [ 57.338207] ? dput+0x46/0x1c0 [ 57.338393] ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338665] ? ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338948] __vfs_removexattr+0x92/0xc0 [ 57.339182] __vfs_removexattr_locked+0xd5/0x190 [ 57.339456] ? preempt_count_sub+0x50/0x80 [ 57.339705] vfs_removexattr+0x5f/0x100 [...] Reproducer uses faultinject facility to fail ocfs2_xa_remove() -> ocfs2_xa_value_truncate() with -ENOMEM. In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following 'rc' check is wrong and execution flow do 'ocfs2_xa_remove_entry(loc);' twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'. Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy. Link: https://lkml.kernel.org/r/20241103193845.2940988-1-andrew.kanner@gmail.com Fixes: 399ff3a748 ("ocfs2: Handle errors while setting external xattr values.") Signed-off-by: Andrew Kanner <andrew.kanner@gmail.com> Reported-by: syzbot+386ce9e60fa1b18aac5b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/671e13ab.050a0220.2b8c0f.01d0.GAE@google.com/T/ Tested-by: syzbot+386ce9e60fa1b18aac5b@syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Jun Piao <piaojun@huawei.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>		2024-11-07 14:14:59 -08:00
..
cluster	introduce fd_file(), convert all accessors to it.	2024-08-12 22:00:43 -04:00
dlm	ocfs2: remove redundant assignment to variable status	2024-05-08 08:41:27 -07:00
dlmfs	ocfs2: remove SLAB_MEM_SPREAD flag usage	2024-03-14 09:17:29 -07:00
acl.c
acl.h
alloc.c	fs: convert block_write_full_page to block_write_full_folio	2023-12-29 11:58:35 -08:00
alloc.h
aops.c	ocfs2: fix uninit-value in ocfs2_get_block()	2024-09-26 14:01:45 -07:00
aops.h	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
blockcheck.c
blockcheck.h
buffer_head_io.c	ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate	2024-09-09 15:15:54 -07:00
buffer_head_io.h
dcache.c
dcache.h
dir.c	Many singleton patches - please see the various changelogs for details.	2024-09-21 08:20:50 -07:00
dir.h
dlmglue.c	ocfs2: use max() to improve ocfs2_dlm_seq_show()	2024-09-01 20:43:38 -07:00
dlmglue.h
export.c	ocfs2: fix sparse warnings	2024-04-25 21:07:04 -07:00
export.h
extent_map.c	ocfs2: fix deadlock in ocfs2_get_system_file_inode	2024-09-26 14:01:44 -07:00
extent_map.h
file.c	ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow	2024-10-28 21:40:40 -07:00
file.h	ocfs2: store cookie in private data	2024-09-12 11:58:44 +02:00
filecheck.c
filecheck.h
heartbeat.c
heartbeat.h
inode.c	ocfs2: fix sparse warnings	2024-04-25 21:07:04 -07:00
inode.h	quota: Properly annotate i_dquot arrays with __rcu	2024-02-08 12:04:59 +01:00
ioctl.c	ocfs2: update inode ctime in ocfs2_fileattr_set	2024-04-25 21:07:01 -07:00
ioctl.h
journal.c	ocfs2: fix null-ptr-deref when journal load failed.	2024-09-09 15:15:53 -07:00
journal.h	ocfs2: fix DIO failure due to insufficient transaction credits	2024-06-24 20:52:10 -07:00
Kconfig
localalloc.c	ocfs2: fix the la space leak when unmounting an ocfs2 volume	2024-09-01 20:43:23 -07:00
localalloc.h
locks.c	ocfs2: adapt to breakup of struct file_lock	2024-02-05 13:11:43 +01:00
locks.h
Makefile
mmap.c	fs: Convert aops->write_begin to take a folio	2024-08-07 11:33:21 +02:00
mmap.h
move_extents.c	ocfs2: improve write IO performance when fragmentation is high	2024-04-25 21:07:03 -07:00
move_extents.h
namei.c	fs: add kernel-doc comments to ocfs2_prepare_orphan_dir()	2024-07-04 23:43:10 -07:00
namei.h
ocfs1_fs_compat.h
ocfs2_fs.h	ocfs2: improve write IO performance when fragmentation is high	2024-04-25 21:07:03 -07:00
ocfs2_ioctl.h
ocfs2_lockid.h
ocfs2_lockingver.h
ocfs2_trace.h	ocfs2: fix DIO failure due to insufficient transaction credits	2024-06-24 20:52:10 -07:00
ocfs2.h	ocfs2: constify struct ocfs2_lock_res_ops	2024-06-24 22:25:10 -07:00
quota_global.c	ocfs2: cleanup return value and mlog in ocfs2_global_read_info()	2024-09-09 16:47:43 -07:00
quota_local.c	ocfs2: cancel dqi_sync_work before freeing oinfo	2024-09-09 15:15:54 -07:00
quota.h
refcounttree.c	ocfs2: reserve space for inline xattr before attaching reflink tree	2024-09-26 14:01:44 -07:00
refcounttree.h
reservations.c	ocfs2: correctly use ocfs2_find_next_zero_bit()	2024-04-25 21:07:01 -07:00
reservations.h
resize.c	ocfs2: improve write IO performance when fragmentation is high	2024-04-25 21:07:03 -07:00
resize.h
slot_map.c
slot_map.h
stack_o2cb.c	ocfs2: constify struct ocfs2_stack_operations	2024-06-24 22:25:10 -07:00
stack_user.c	ocfs2: constify struct ocfs2_stack_operations	2024-06-24 22:25:10 -07:00
stackglue.c
stackglue.h	ocfs2: constify struct ocfs2_stack_operations	2024-06-24 22:25:10 -07:00
suballoc.c	ocfs2: speed up chain-list searching	2024-04-25 21:07:04 -07:00
suballoc.h	ocfs2: improve write IO performance when fragmentation is high	2024-04-25 21:07:03 -07:00
super.c	\n	2024-09-23 10:49:28 -07:00
super.h
symlink.c
symlink.h
sysfile.c
sysfile.h
uptodate.c
uptodate.h
xattr.c	ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()	2024-11-07 14:14:59 -08:00
xattr.h