From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+2643e825238d7aabb37f@syzkaller.appspotmail.com,
Anant Thazhemadam <anant.thazhemadam@gmail.com>,
Jan Kara <jack@suse.cz>
Subject: [PATCH 5.10 36/40] fs: quota: fix array-index-out-of-bounds bug by passing correct argument to vfs_cleanup_quota_inode()
Date: Wed, 23 Dec 2020 16:33:37 +0100 [thread overview]
Message-ID: <20201223150517.275754032@linuxfoundation.org> (raw)
In-Reply-To: <20201223150515.553836647@linuxfoundation.org>
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
commit e51d68e76d604c6d5d1eb13ae1d6da7f6c8c0dfc upstream.
When dquot_resume() was last updated, the argument that got passed
to vfs_cleanup_quota_inode was incorrectly set.
If type = -1 and dquot_load_quota_sb() returns a negative value,
then vfs_cleanup_quota_inode() gets called with -1 passed as an
argument, and this leads to an array-index-out-of-bounds bug.
Fix this issue by correctly passing the arguments.
Fixes: ae45f07d47cc ("quota: Simplify dquot_resume()")
Link: https://lore.kernel.org/r/20201208194338.7064-1-anant.thazhemadam@gmail.com
Reported-by: syzbot+2643e825238d7aabb37f@syzkaller.appspotmail.com
Tested-by: syzbot+2643e825238d7aabb37f@syzkaller.appspotmail.com
CC: stable@vger.kernel.org
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/quota/dquot.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -2455,7 +2455,7 @@ int dquot_resume(struct super_block *sb,
ret = dquot_load_quota_sb(sb, cnt, dqopt->info[cnt].dqi_fmt_id,
flags);
if (ret < 0)
- vfs_cleanup_quota_inode(sb, type);
+ vfs_cleanup_quota_inode(sb, cnt);
}
return ret;
next prev parent reply other threads:[~2020-12-23 15:35 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-23 15:33 [PATCH 5.10 00/40] 5.10.3-rc1 review Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 01/40] net: ipconfig: Avoid spurious blank lines in boot log Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 02/40] x86/split-lock: Avoid returning with interrupts enabled Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 03/40] exfat: Avoid allocating upcase table using kcalloc() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 04/40] soc/tegra: fuse: Fix index bug in get_process_id Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 05/40] usb: mtu3: fix memory corruption in mtu3_debugfs_regset() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 06/40] USB: serial: option: add interface-number sanity check to flag handling Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 07/40] USB: gadget: f_acm: add support for SuperSpeed Plus Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 08/40] USB: gadget: f_midi: setup SuperSpeed Plus descriptors Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 09/40] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 10/40] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 11/40] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 12/40] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 13/40] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 14/40] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 15/40] coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 16/40] coresight: tmc-etr: Check if page is valid before dma_map_page() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 17/40] coresight: tmc-etr: Fix barrier packet insertion for perf buffer Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 18/40] coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 19/40] coresight: etm4x: Skip setting LPOVERRIDE bit for qcom, skip-power-up Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 20/40] coresight: etm4x: Fix accesses to TRCVMIDCTLR1 Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 21/40] coresight: etm4x: Fix accesses to TRCCIDCTLR1 Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 22/40] coresight: etm4x: Fix accesses to TRCPROCSELR Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 23/40] coresight: etm4x: Handle TRCVIPCSSCTLR accesses Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 24/40] f2fs: fix to seek incorrect data offset in inline data file Greg Kroah-Hartman
2020-12-24 1:11 ` Chao Yu
2020-12-24 7:52 ` Greg Kroah-Hartman
2020-12-24 9:38 ` Chao Yu
2020-12-23 15:33 ` [PATCH 5.10 25/40] f2fs: init dirty_secmap incorrectly Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 26/40] scsi: megaraid_sas: Check user-provided offsets Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 27/40] HID: i2c-hid: add Vero K147 to descriptor override Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 28/40] serial_core: Check for port state when tty is in error state Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 29/40] fscrypt: remove kernel-internal constants from UAPI header Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 30/40] fscrypt: add fscrypt_is_nokey_name() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 31/40] ubifs: prevent creating duplicate encrypted filenames Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 32/40] ext4: " Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 33/40] f2fs: " Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 34/40] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 35/40] quota: Sanity-check quota file headers on load Greg Kroah-Hartman
2020-12-23 15:33 ` Greg Kroah-Hartman [this message]
2020-12-23 15:33 ` [PATCH 5.10 37/40] media: msi2500: assign SPI bus number dynamically Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 38/40] crypto: af_alg - avoid undefined behavior accessing salg_name Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 39/40] nl80211: validate key indexes for cfg80211_registered_device Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 40/40] md: fix a warning caused by a race between concurrent md_ioctl()s Greg Kroah-Hartman
2020-12-23 19:26 ` [PATCH 5.10 00/40] 5.10.3-rc1 review Jon Hunter
2020-12-26 15:07 ` Greg Kroah-Hartman
2020-12-24 0:56 ` Daniel Díaz
2020-12-26 15:07 ` Greg Kroah-Hartman
2020-12-24 9:43 ` Jeffrin Jose T
2020-12-26 15:06 ` Greg Kroah-Hartman
2020-12-27 15:50 ` Jeffrin Jose T
2020-12-27 16:05 ` Greg Kroah-Hartman
2020-12-27 21:33 ` Jeffrin Jose T
2020-12-28 9:50 ` Pavel Machek
2020-12-28 20:41 ` Guenter Roeck
2021-01-03 13:07 ` Jeffrin Jose T
2021-01-04 6:21 ` Greg Kroah-Hartman
2021-01-06 19:38 ` Jeffrin Jose T
2021-01-06 19:49 ` Greg Kroah-Hartman
2021-01-06 23:56 ` Jeffrin Jose T
2020-12-24 15:26 ` Guenter Roeck
2020-12-26 15:06 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201223150517.275754032@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=anant.thazhemadam@gmail.com \
--cc=jack@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+2643e825238d7aabb37f@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.