4.9-stable patches

added patches:
	ext4-fix-bug_on-in-ext4_writepages.patch
	ext4-fix-use-after-free-in-ext4_rename_dir_prepare.patch
	ext4-verify-dir-block-before-splitting-it.patch

diff --git a/queue-4.9/ext4-fix-bug_on-in-ext4_writepages.patch b/queue-4.9/ext4-fix-bug_on-in-ext4_writepages.patch
new file mode 100644 (file)
index 0000000..0b6864f
--- /dev/null
+++ b/queue-4.9/ext4-fix-bug_on-in-ext4_writepages.patch
@@ -0,0 +1,107 @@
+From ef09ed5d37b84d18562b30cf7253e57062d0db05 Mon Sep 17 00:00:00 2001
+From: Ye Bin <yebin10@huawei.com>
+Date: Mon, 16 May 2022 20:26:34 +0800
+Subject: ext4: fix bug_on in ext4_writepages
+
+From: Ye Bin <yebin10@huawei.com>
+
+commit ef09ed5d37b84d18562b30cf7253e57062d0db05 upstream.
+
+we got issue as follows:
+EXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free cls
+------------[ cut here ]------------
+kernel BUG at fs/ext4/inode.c:2708!
+invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
+CPU: 2 PID: 2147 Comm: rep Not tainted 5.18.0-rc2-next-20220413+ #155
+RIP: 0010:ext4_writepages+0x1977/0x1c10
+RSP: 0018:ffff88811d3e7880 EFLAGS: 00010246
+RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88811c098000
+RDX: 0000000000000000 RSI: ffff88811c098000 RDI: 0000000000000002
+RBP: ffff888128140f50 R08: ffffffffb1ff6387 R09: 0000000000000000
+R10: 0000000000000007 R11: ffffed10250281ea R12: 0000000000000001
+R13: 00000000000000a4 R14: ffff88811d3e7bb8 R15: ffff888128141028
+FS:  00007f443aed9740(0000) GS:ffff8883aef00000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000020007200 CR3: 000000011c2a4000 CR4: 00000000000006e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ do_writepages+0x130/0x3a0
+ filemap_fdatawrite_wbc+0x83/0xa0
+ filemap_flush+0xab/0xe0
+ ext4_alloc_da_blocks+0x51/0x120
+ __ext4_ioctl+0x1534/0x3210
+ __x64_sys_ioctl+0x12c/0x170
+ do_syscall_64+0x3b/0x90
+
+It may happen as follows:
+1. write inline_data inode
+vfs_write
+  new_sync_write
+    ext4_file_write_iter
+      ext4_buffered_write_iter
+        generic_perform_write
+          ext4_da_write_begin
+            ext4_da_write_inline_data_begin -> If inline data size too
+            small will allocate block to write, then mapping will has
+            dirty page
+                ext4_da_convert_inline_data_to_extent ->clear EXT4_STATE_MAY_INLINE_DATA
+2. fallocate
+do_vfs_ioctl
+  ioctl_preallocate
+    vfs_fallocate
+      ext4_fallocate
+        ext4_convert_inline_data
+          ext4_convert_inline_data_nolock
+            ext4_map_blocks -> fail will goto restore data
+            ext4_restore_inline_data
+              ext4_create_inline_data
+              ext4_write_inline_data
+              ext4_set_inode_state -> set inode EXT4_STATE_MAY_INLINE_DATA
+3. writepages
+__ext4_ioctl
+  ext4_alloc_da_blocks
+    filemap_flush
+      filemap_fdatawrite_wbc
+        do_writepages
+          ext4_writepages
+            if (ext4_has_inline_data(inode))
+              BUG_ON(ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))
+
+The root cause of this issue is we destory inline data until call
+ext4_writepages under delay allocation mode.  But there maybe already
+convert from inline to extent.  To solve this issue, we call
+filemap_flush first..
+
+Cc: stable@kernel.org
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20220516122634.1690462-1-yebin10@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/inline.c |   12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1984,6 +1984,18 @@ int ext4_convert_inline_data(struct inod
+       if (!ext4_has_inline_data(inode)) {
+               ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
+               return 0;
++      } else if (!ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) {
++              /*
++               * Inode has inline data but EXT4_STATE_MAY_INLINE_DATA is
++               * cleared. This means we are in the middle of moving of
++               * inline data to delay allocated block. Just force writeout
++               * here to finish conversion.
++               */
++              error = filemap_flush(inode->i_mapping);
++              if (error)
++                      return error;
++              if (!ext4_has_inline_data(inode))
++                      return 0;
+       }
+ 
+       needed_blocks = ext4_writepage_trans_blocks(inode);

diff --git a/queue-4.9/ext4-fix-use-after-free-in-ext4_rename_dir_prepare.patch b/queue-4.9/ext4-fix-use-after-free-in-ext4_rename_dir_prepare.patch
new file mode 100644 (file)
index 0000000..361b2b0
--- /dev/null
+++ b/queue-4.9/ext4-fix-use-after-free-in-ext4_rename_dir_prepare.patch
@@ -0,0 +1,125 @@
+From 0be698ecbe4471fcad80e81ec6a05001421041b3 Mon Sep 17 00:00:00 2001
+From: Ye Bin <yebin10@huawei.com>
+Date: Thu, 14 Apr 2022 10:52:23 +0800
+Subject: ext4: fix use-after-free in ext4_rename_dir_prepare
+
+From: Ye Bin <yebin10@huawei.com>
+
+commit 0be698ecbe4471fcad80e81ec6a05001421041b3 upstream.
+
+We got issue as follows:
+EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue
+ext4_get_first_dir_block: bh->b_data=0xffff88810bee6000 len=34478
+ext4_get_first_dir_block: *parent_de=0xffff88810beee6ae bh->b_data=0xffff88810bee6000
+ext4_rename_dir_prepare: [1] parent_de=0xffff88810beee6ae
+==================================================================
+BUG: KASAN: use-after-free in ext4_rename_dir_prepare+0x152/0x220
+Read of size 4 at addr ffff88810beee6ae by task rep/1895
+
+CPU: 13 PID: 1895 Comm: rep Not tainted 5.10.0+ #241
+Call Trace:
+ dump_stack+0xbe/0xf9
+ print_address_description.constprop.0+0x1e/0x220
+ kasan_report.cold+0x37/0x7f
+ ext4_rename_dir_prepare+0x152/0x220
+ ext4_rename+0xf44/0x1ad0
+ ext4_rename2+0x11c/0x170
+ vfs_rename+0xa84/0x1440
+ do_renameat2+0x683/0x8f0
+ __x64_sys_renameat+0x53/0x60
+ do_syscall_64+0x33/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+RIP: 0033:0x7f45a6fc41c9
+RSP: 002b:00007ffc5a470218 EFLAGS: 00000246 ORIG_RAX: 0000000000000108
+RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f45a6fc41c9
+RDX: 0000000000000005 RSI: 0000000020000180 RDI: 0000000000000005
+RBP: 00007ffc5a470240 R08: 00007ffc5a470160 R09: 0000000020000080
+R10: 00000000200001c0 R11: 0000000000000246 R12: 0000000000400bb0
+R13: 00007ffc5a470320 R14: 0000000000000000 R15: 0000000000000000
+
+The buggy address belongs to the page:
+page:00000000440015ce refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x10beee
+flags: 0x200000000000000()
+raw: 0200000000000000 ffffea00043ff4c8 ffffea0004325608 0000000000000000
+raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff88810beee580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+ ffff88810beee600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+>ffff88810beee680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+                                  ^
+ ffff88810beee700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+ ffff88810beee780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+==================================================================
+Disabling lock debugging due to kernel taint
+ext4_rename_dir_prepare: [2] parent_de->inode=3537895424
+ext4_rename_dir_prepare: [3] dir=0xffff888124170140
+ext4_rename_dir_prepare: [4] ino=2
+ext4_rename_dir_prepare: ent->dir->i_ino=2 parent=-757071872
+
+Reason is first directory entry which 'rec_len' is 34478, then will get illegal
+parent entry. Now, we do not check directory entry after read directory block
+in 'ext4_get_first_dir_block'.
+To solve this issue, check directory entry in 'ext4_get_first_dir_block'.
+
+[ Trigger an ext4_error() instead of just warning if the directory is
+  missing a '.' or '..' entry.   Also make sure we return an error code
+  if the file system is corrupted.  -TYT ]
+
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20220414025223.4113128-1-yebin10@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/namei.c |   30 +++++++++++++++++++++++++++---
+ 1 file changed, 27 insertions(+), 3 deletions(-)
+
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -3318,6 +3318,9 @@ static struct buffer_head *ext4_get_firs
+       struct buffer_head *bh;
+ 
+       if (!ext4_has_inline_data(inode)) {
++              struct ext4_dir_entry_2 *de;
++              unsigned int offset;
++
+               /* The first directory block must not be a hole, so
+                * treat it as DIRENT_HTREE
+                */
+@@ -3326,9 +3329,30 @@ static struct buffer_head *ext4_get_firs
+                       *retval = PTR_ERR(bh);
+                       return NULL;
+               }
+-              *parent_de = ext4_next_entry(
+-                                      (struct ext4_dir_entry_2 *)bh->b_data,
+-                                      inode->i_sb->s_blocksize);
++
++              de = (struct ext4_dir_entry_2 *) bh->b_data;
++              if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data,
++                                       bh->b_size, 0) ||
++                  le32_to_cpu(de->inode) != inode->i_ino ||
++                  strcmp(".", de->name)) {
++                      EXT4_ERROR_INODE(inode, "directory missing '.'");
++                      brelse(bh);
++                      *retval = -EFSCORRUPTED;
++                      return NULL;
++              }
++              offset = ext4_rec_len_from_disk(de->rec_len,
++                                              inode->i_sb->s_blocksize);
++              de = ext4_next_entry(de, inode->i_sb->s_blocksize);
++              if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data,
++                                       bh->b_size, offset) ||
++                  le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) {
++                      EXT4_ERROR_INODE(inode, "directory missing '..'");
++                      brelse(bh);
++                      *retval = -EFSCORRUPTED;
++                      return NULL;
++              }
++              *parent_de = de;
++
+               return bh;
+       }
+ 

diff --git a/queue-4.9/ext4-verify-dir-block-before-splitting-it.patch b/queue-4.9/ext4-verify-dir-block-before-splitting-it.patch
new file mode 100644 (file)
index 0000000..1335ab7
--- /dev/null
+++ b/queue-4.9/ext4-verify-dir-block-before-splitting-it.patch
@@ -0,0 +1,88 @@
+From 46c116b920ebec58031f0a78c5ea9599b0d2a371 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 18 May 2022 11:33:28 +0200
+Subject: ext4: verify dir block before splitting it
+
+From: Jan Kara <jack@suse.cz>
+
+commit 46c116b920ebec58031f0a78c5ea9599b0d2a371 upstream.
+
+Before splitting a directory block verify its directory entries are sane
+so that the splitting code does not access memory it should not.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20220518093332.13986-1-jack@suse.cz
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/namei.c |   32 +++++++++++++++++++++-----------
+ 1 file changed, 21 insertions(+), 11 deletions(-)
+
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -270,9 +270,9 @@ static struct dx_frame *dx_probe(struct
+                                struct dx_hash_info *hinfo,
+                                struct dx_frame *frame);
+ static void dx_release(struct dx_frame *frames);
+-static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de,
+-                     unsigned blocksize, struct dx_hash_info *hinfo,
+-                     struct dx_map_entry map[]);
++static int dx_make_map(struct inode *dir, struct buffer_head *bh,
++                     struct dx_hash_info *hinfo,
++                     struct dx_map_entry *map_tail);
+ static void dx_sort_map(struct dx_map_entry *map, unsigned count);
+ static struct ext4_dir_entry_2 *dx_move_dirents(char *from, char *to,
+               struct dx_map_entry *offsets, int count, unsigned blocksize);
+@@ -1185,15 +1185,23 @@ static inline int search_dirblock(struct
+  * Create map of hash values, offsets, and sizes, stored at end of block.
+  * Returns number of entries mapped.
+  */
+-static int dx_make_map(struct inode *dir, struct ext4_dir_entry_2 *de,
+-                     unsigned blocksize, struct dx_hash_info *hinfo,
++static int dx_make_map(struct inode *dir, struct buffer_head *bh,
++                     struct dx_hash_info *hinfo,
+                      struct dx_map_entry *map_tail)
+ {
+       int count = 0;
+-      char *base = (char *) de;
++      struct ext4_dir_entry_2 *de = (struct ext4_dir_entry_2 *)bh->b_data;
++      unsigned int buflen = bh->b_size;
++      char *base = bh->b_data;
+       struct dx_hash_info h = *hinfo;
+ 
+-      while ((char *) de < base + blocksize) {
++      if (ext4_has_metadata_csum(dir->i_sb))
++              buflen -= sizeof(struct ext4_dir_entry_tail);
++
++      while ((char *) de < base + buflen) {
++              if (ext4_check_dir_entry(dir, NULL, de, bh, base, buflen,
++                                       ((char *)de) - base))
++                      return -EFSCORRUPTED;
+               if (de->name_len && de->inode) {
+                       ext4fs_dirhash(de->name, de->name_len, &h);
+                       map_tail--;
+@@ -1203,8 +1211,7 @@ static int dx_make_map(struct inode *dir
+                       count++;
+                       cond_resched();
+               }
+-              /* XXX: do we need to check rec_len == 0 case? -Chris */
+-              de = ext4_next_entry(de, blocksize);
++              de = ext4_next_entry(de, dir->i_sb->s_blocksize);
+       }
+       return count;
+ }
+@@ -1755,8 +1762,11 @@ static struct ext4_dir_entry_2 *do_split
+ 
+       /* create map in the end of data2 block */
+       map = (struct dx_map_entry *) (data2 + blocksize);
+-      count = dx_make_map(dir, (struct ext4_dir_entry_2 *) data1,
+-                           blocksize, hinfo, map);
++      count = dx_make_map(dir, *bh, hinfo, map);
++      if (count < 0) {
++              err = count;
++              goto journal_error;
++      }
+       map -= count;
+       dx_sort_map(map, count);
+       /* Ensure that neither split block is over half full */

diff --git a/queue-4.9/series b/queue-4.9/series
index e329aaf7a5463e49ffdd072e19bb62b843fb9a15..0454850c448698ac6357e6b9cea9b23b1e156ac9 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -76,3 +76,6 @@ iommu-amd-increase-timeout-waiting-for-ga-log-enable.patch
 wifi-mac80211-fix-use-after-free-in-chanctx-code.patch
 iwlwifi-mvm-fix-assert-1f04-upon-reconfig.patch
 fs-writeback-writeback_sb_inodes-recalculate-wrote-according-skipped-pages.patch
+ext4-fix-use-after-free-in-ext4_rename_dir_prepare.patch
+ext4-fix-bug_on-in-ext4_writepages.patch
+ext4-verify-dir-block-before-splitting-it.patch