From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,INCLUDES_PATCH,LOTS_OF_MONEY,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CBFC6C43381 for ; Wed, 27 Mar 2019 19:29:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9A0982075C for ; Wed, 27 Mar 2019 19:29:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553714994; bh=qicfh6tRRMExRoNvRo7CsD0OxLrIU4VlJJaLWH//wDA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=f7wbVU5RS6HWpHcXbbPab7JvBM9I15Y8bV0hmm0NDi2XmGDK2QbBYgb7rd7TccqoR XizA9HG7Nnon14s6xom9KnjdL3/zrPahwomEWux9siABMLi3JhS0chURPmLzFCco8i IIAUI58R8hGcn90VblQGyYkAytnhboqxXUSDjvWI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387591AbfC0T3x (ORCPT ); Wed, 27 Mar 2019 15:29:53 -0400 Received: from mail.kernel.org ([198.145.29.99]:44024 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732705AbfC0SDl (ORCPT ); Wed, 27 Mar 2019 14:03:41 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 27377217D9; Wed, 27 Mar 2019 18:03:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553709820; bh=qicfh6tRRMExRoNvRo7CsD0OxLrIU4VlJJaLWH//wDA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Pl+kh09VgO5P8Yj6EwhWwFB53GXpU4L3gjH8uWJWdpzu17ItkfQLYsWmaxtLJbjuZ qRqjCEiZT6dn9alp2uIW5ZygEkBJCTxHaNZv0DvmbSUOUhm1A55Opmta76V+a7clD9 Vqfc/Vmrlc3T1bVVnoeRtYzU72E0aJH7klGdYEik= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Carlos Maiolino , Jens Axboe , Sasha Levin , linux-fsdevel@vger.kernel.org Subject: [PATCH AUTOSEL 5.0 059/262] fs: fix guard_bio_eod to check for real EOD errors Date: Wed, 27 Mar 2019 13:58:34 -0400 Message-Id: <20190327180158.10245-59-sashal@kernel.org> X-Mailer: git-send-email 2.19.1 In-Reply-To: <20190327180158.10245-1-sashal@kernel.org> References: <20190327180158.10245-1-sashal@kernel.org> MIME-Version: 1.0 X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Carlos Maiolino [ Upstream commit dce30ca9e3b676fb288c33c1f4725a0621361185 ] guard_bio_eod() can truncate a segment in bio to allow it to do IO on odd last sectors of a device. It already checks if the IO starts past EOD, but it does not consider the possibility of an IO request starting within device boundaries can contain more than one segment past EOD. In such cases, truncated_bytes can be bigger than PAGE_SIZE, and will underflow bvec->bv_len. Fix this by checking if truncated_bytes is lower than PAGE_SIZE. This situation has been found on filesystems such as isofs and vfat, which doesn't check the device size before mount, if the device is smaller than the filesystem itself, a readahead on such filesystem, which spans EOD, can trigger this situation, leading a call to zero_user() with a wrong size possibly corrupting memory. I didn't see any crash, or didn't let the system run long enough to check if memory corruption will be hit somewhere, but adding instrumentation to guard_bio_end() to check truncated_bytes size, was enough to see the error. The following script can trigger the error. MNT=/mnt IMG=./DISK.img DEV=/dev/loop0 mkfs.vfat $IMG mount $IMG $MNT cp -R /etc $MNT &> /dev/null umount $MNT losetup -D losetup --find --show --sizelimit 16247280 $IMG mount $DEV $MNT find $MNT -type f -exec cat {} + >/dev/null Kudos to Eric Sandeen for coming up with the reproducer above Reviewed-by: Ming Lei Signed-off-by: Carlos Maiolino Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin --- fs/buffer.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/buffer.c b/fs/buffer.c index 48318fb74938..cab7a026876b 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -3027,6 +3027,13 @@ void guard_bio_eod(int op, struct bio *bio) /* Uhhuh. We've got a bio that straddles the device size! */ truncated_bytes = bio->bi_iter.bi_size - (maxsector << 9); + /* + * The bio contains more than one segment which spans EOD, just return + * and let IO layer turn it into an EIO + */ + if (truncated_bytes > bvec->bv_len) + return; + /* Truncate the bio.. */ bio->bi_iter.bi_size -= truncated_bytes; bvec->bv_len -= truncated_bytes; -- 2.19.1