From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Hulk Robot <hulkci@huawei.com>,
Guo Xuenan <guoxuenan@huawei.com>, Christoph Hellwig <hch@lst.de>,
"Darrick J. Wong" <djwong@kernel.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.10 24/97] fs: fix an infinite loop in iomap_fiemap
Date: Mon, 23 May 2022 19:05:28 +0200 [thread overview]
Message-ID: <20220523165816.069605342@linuxfoundation.org> (raw)
In-Reply-To: <20220523165812.244140613@linuxfoundation.org>
From: Guo Xuenan <guoxuenan@huawei.com>
[ Upstream commit 49df34221804cfd6384135b28b03c9461a31d024 ]
when get fiemap starting from MAX_LFS_FILESIZE, (maxbytes - *len) < start
will always true , then *len set zero. because of start offset is beyond
file size, for erofs filesystem it will always return iomap.length with
zero,iomap iterate will enter infinite loop. it is necessary cover this
corner case to avoid this situation.
------------[ cut here ]------------
WARNING: CPU: 7 PID: 905 at fs/iomap/iter.c:35 iomap_iter+0x97f/0xc70
Modules linked in: xfs erofs
CPU: 7 PID: 905 Comm: iomap Tainted: G W 5.17.0-rc8 #27
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:iomap_iter+0x97f/0xc70
Code: 85 a1 fc ff ff e8 71 be 9c ff 0f 1f 44 00 00 e9 92 fc ff ff e8 62 be 9c ff 0f 0b b8 fb ff ff ff e9 fc f8 ff ff e8 51 be 9c ff <0f> 0b e9 2b fc ff ff e8 45 be 9c ff 0f 0b e9 e1 fb ff ff e8 39 be
RSP: 0018:ffff888060a37ab0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888060a37bb0 RCX: 0000000000000000
RDX: ffff88807e19a900 RSI: ffffffff81a7da7f RDI: ffff888060a37be0
RBP: 7fffffffffffffff R08: 0000000000000000 R09: ffff888060a37c20
R10: ffff888060a37c67 R11: ffffed100c146f8c R12: 7fffffffffffffff
R13: 0000000000000000 R14: ffff888060a37bd8 R15: ffff888060a37c20
FS: 00007fd3cca01540(0000) GS:ffff888108780000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010820 CR3: 0000000054b92000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
iomap_fiemap+0x1c9/0x2f0
erofs_fiemap+0x64/0x90 [erofs]
do_vfs_ioctl+0x40d/0x12e0
__x64_sys_ioctl+0xaa/0x1c0
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x44/0xae
</TASK>
---[ end trace 0000000000000000 ]---
watchdog: BUG: soft lockup - CPU#7 stuck for 26s! [iomap:905]
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Guo Xuenan <guoxuenan@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
[djwong: fix some typos]
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ioctl.c b/fs/ioctl.c
index 4e6cc0a7d69c..7bcc60091287 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -170,7 +170,7 @@ int fiemap_prep(struct inode *inode, struct fiemap_extent_info *fieinfo,
if (*len == 0)
return -EINVAL;
- if (start > maxbytes)
+ if (start >= maxbytes)
return -EFBIG;
/*
--
2.35.1
next prev parent reply other threads:[~2022-05-23 17:25 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-23 17:05 [PATCH 5.10 00/97] 5.10.118-rc1 review Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 01/97] usb: gadget: fix race when gadget driver register via ioctl Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 02/97] io_uring: always grab file table for deferred statx Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 03/97] floppy: use a statically allocated error counter Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 04/97] Revert "drm/i915/opregion: check port number bounds for SWSCI display power state" Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 05/97] igc: Remove _I_PHY_ID checking Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 06/97] igc: Remove phy->type checking Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 07/97] igc: Update I226_K device ID Greg Kroah-Hartman
2022-05-25 10:45 ` Pavel Machek
2022-05-26 4:02 ` Neftin, Sasha
2022-05-23 17:05 ` [PATCH 5.10 08/97] rtc: fix use-after-free on device removal Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 09/97] rtc: pcf2127: fix bug when reading alarm registers Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 10/97] um: Cleanup syscall_handler_t definition/cast, fix warning Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 11/97] Input: add bounds checking to input_set_capability() Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 12/97] Input: stmfts - fix reference leak in stmfts_input_open Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 13/97] nvme-pci: add quirks for Samsung X5 SSDs Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 14/97] gfs2: Disable page faults during lockless buffered reads Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 15/97] rtc: sun6i: Fix time overflow handling Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 16/97] crypto: stm32 - fix reference leak in stm32_crc_remove Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 17/97] crypto: x86/chacha20 - Avoid spurious jumps to other functions Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 18/97] ALSA: hda/realtek: Enable headset mic on Lenovo P360 Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 19/97] s390/pci: improve zpci_dev reference counting Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 20/97] vhost_vdpa: dont setup irq offloading when irq_num < 0 Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 21/97] tools/virtio: compile with -pthread Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 22/97] nvme-multipath: fix hang when disk goes live over reconnect Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 23/97] rtc: mc146818-lib: Fix the AltCentury for AMD platforms Greg Kroah-Hartman
2022-05-23 17:05 ` Greg Kroah-Hartman [this message]
2022-05-23 17:05 ` [PATCH 5.10 25/97] MIPS: lantiq: check the return value of kzalloc() Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 26/97] drbd: remove usage of list iterator variable after loop Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 27/97] platform/chrome: cros_ec_debugfs: detach log reader wq from devm Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 28/97] ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 29/97] nilfs2: fix lockdep warnings in page operations for btree nodes Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 30/97] nilfs2: fix lockdep warnings during disk space reclamation Greg Kroah-Hartman
2022-05-23 17:05 ` [PATCH 5.10 31/97] Revert "swiotlb: fix info leak with DMA_FROM_DEVICE" Greg Kroah-Hartman
2022-05-23 18:25 ` [PATCH 5.10 00/97] 5.10.118-rc1 review Florian Fainelli
2022-05-23 21:36 ` Daniel Díaz
2022-05-25 7:16 ` Greg Kroah-Hartman
2022-05-23 22:56 ` Shuah Khan
2022-05-24 9:24 ` Fox Chen
2022-05-24 14:49 ` Sudip Mukherjee
2022-05-24 15:25 ` Pavel Machek
2022-05-24 20:04 ` Guenter Roeck
2022-05-25 1:05 ` Samuel Zou
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220523165816.069605342@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=djwong@kernel.org \
--cc=guoxuenan@huawei.com \
--cc=hch@lst.de \
--cc=hulkci@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.