twx-linux/fs at v5.4.243 - twx-linux - Gitea: Git with a cup of tea

TWxSoftware/twx-linux

Files

T

History

Theodore Ts'o ba04d6af5a ext4: fix invalid free tracking in ext4_xattr_move_to_block()

commit b87c7cdf2b upstream.

In ext4_xattr_move_to_block(), the value of the extended attribute
which we need to move to an external block may be allocated by
kvmalloc() if the value is stored in an external inode.  So at the end
of the function the code tried to check if this was the case by
testing entry->e_value_inum.

However, at this point, the pointer to the xattr entry is no longer
valid, because it was removed from the original location where it had
been stored.  So we could end up calling kvfree() on a pointer which
was not allocated by kvmalloc(); or we could also potentially leak
memory by not freeing the buffer when it should be freed.  Fix this by
storing whether it should be freed in a separate variable.

Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20230430160426.581366-1-tytso@mit.edu
Link: https://syzkaller.appspot.com/bug?id=5c2aee8256e30b55ccf57312c16d88417adbd5e1
Link: https://syzkaller.appspot.com/bug?id=41a6b5d4917c0412eb3b3c3c604965bed7d7420b
Reported-by: syzbot+64b645917ce07d89bde5@syzkaller.appspotmail.com
Reported-by: syzbot+0d042627c4f2ad332195@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-05-17 11:36:03 +02:00

..

9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"

2022-06-22 14:11:02 +02:00

…

affs: initialize fsdata in affs_truncate()

2023-02-06 07:52:36 +01:00

afs: Fix updating of i_size with dv jump from server

2023-05-17 11:35:54 +02:00

…

…

…

btrfs: print-tree: parent bytenr must be aligned to sector size

2023-05-17 11:36:00 +02:00

…

ceph: flush cap releases when the session is flushed

2023-02-22 12:50:33 +01:00

cifs: fix pcchunk length type in smb2_copychunk_range

2023-05-17 11:36:00 +02:00

coda: Avoid partial allocation of sig_inputArgs

2023-03-11 16:43:56 +01:00

configfs: fix possible memory leak in configfs_create_dir()

2023-01-18 11:41:09 +01:00

…

…

debugfs: regset32: Add Runtime PM support

2023-05-17 11:35:32 +02:00

…

fs: dlm: handle -EBUSY first in lock arg validation

2022-10-26 13:22:14 +02:00

…

…

…

erofs: fix potential overflow calculating xattr_isize

2023-05-17 11:35:35 +02:00

…

ext2: Add more validity checks for inode counts

2022-08-25 11:17:28 +02:00

ext4: fix invalid free tracking in ext4_xattr_move_to_block()

2023-05-17 11:36:03 +02:00

f2fs: fix potential corruption when moving a directory

2023-05-17 11:36:02 +02:00

fat: add ratelimit to fat*_ent_bread()

2022-06-14 18:11:30 +02:00

…

…

fuse: lock inode unconditionally in fuse_fallocate()

2022-12-08 11:23:01 +01:00

gfs2: Always check inode size of inline inodes

2023-04-05 11:16:46 +02:00

hfs: fix missing hfs_bnode_get() in __hfs_bnode_create

2023-03-11 16:43:59 +01:00

fs: hfsplus: fix UAF issue in hfsplus_put_super

2023-03-11 16:43:59 +01:00

…

…

hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()

2023-01-18 11:41:38 +01:00

iomap: iomap_write_failed fix

2022-06-14 18:11:36 +02:00

…

jbd2: wake up journal waiters in FIFO order, not LIFO

2022-10-26 13:22:17 +02:00

jffs2: correct logic when creating a hole in jffs2_write_begin

2023-03-22 13:28:07 +01:00

fs/jfs: fix shift exponent db_agl2size negative

2023-03-11 16:44:07 +01:00

kernfs: fix use-after-free in __kernfs_remove

2022-11-03 23:56:54 +09:00

…

minix: fix bug when opening a file with O_DIRECT

2022-04-15 14:18:35 +02:00

NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease

2023-05-17 11:35:51 +02:00

…

NFSD: callback request does not use correct credential for AUTH_SYS

2023-04-20 12:07:33 +02:00

nilfs2: fix infinite loop in nilfs_mdt_get_block()

2023-05-17 11:35:54 +02:00

…

inotify: Avoid reporting event with invalid wd

2023-05-17 11:36:01 +02:00

ntfs: check overflow when iterating ATTR_RECORDs

2022-11-25 17:42:22 +01:00

ocfs2: fix data corruption after failed write

2023-04-05 11:16:42 +02:00

…

…

orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()

2023-01-18 11:41:39 +01:00

ovl: Use ovl mounter's fsuid and fsgid in ovl_link()

2023-01-18 11:41:43 +01:00

mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps

2023-02-22 12:50:28 +01:00

pstore: Revert pmsg_lock back to a normal mutex

2023-05-17 11:35:45 +02:00

…

…

ext4: fix bug_on in __es_tree_search caused by bad quota inode

2023-01-18 11:42:02 +01:00

…

reiserfs: Add security prefix to xattr name in reiserfs_security_write()

2023-05-17 11:35:33 +02:00

…

revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"

2023-02-22 12:50:39 +01:00

…

fs: sysv: Fix sysv_nblocks() returns wrong value

2023-01-18 11:40:58 +01:00

tracefs: Only clobber mode/uid/gid on remount if asked

2022-09-20 12:28:00 +02:00

ubifs: Free memory for tmpfile name

2023-05-17 11:35:34 +02:00

udf: Fix file corruption when appending just after end of preallocated extent

2023-03-11 16:44:01 +01:00

…

…

fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY

2023-04-05 11:16:42 +02:00

xfs: fix forkoff miscalculation related to XFS_LITINO(mp)

2023-04-26 11:24:06 +02:00

aio.c

aio: fix mremap after fork null-deref

2023-02-22 12:50:35 +01:00

anon_inodes.c

…

attr.c

vfs: Check the truncate maximum size in inode_newsize_ok()

2022-08-25 11:17:21 +02:00

bad_inode.c

…

binfmt_aout.c

binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf

2023-01-18 11:41:46 +01:00

binfmt_elf_fdpic.c

binfmt: Fix error return code in load_elf_fdpic_binary()

2023-01-18 11:41:46 +01:00

binfmt_elf.c

…

binfmt_em86.c

…

binfmt_flat.c

binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf

2023-01-18 11:41:46 +01:00

binfmt_misc.c

binfmt_misc: fix shift-out-of-bounds in check_special_flags

2023-01-18 11:41:33 +01:00

binfmt_script.c

…

block_dev.c

…

buffer.c

mm: fs: initialize fsdata passed to write_begin/write_end interface

2022-11-25 17:42:22 +01:00

char_dev.c

chardev: fix error handling in cdev_device_add()

2023-01-18 11:41:25 +01:00

compat_binfmt_elf.c

…

compat_ioctl.c

compat_ioctl: remove /dev/random commands

2022-06-22 14:11:03 +02:00

compat.c

…

coredump.c

…

d_path.c

…

dax.c

dax: fix cache flush on PMD-mapped pages

2022-06-14 18:11:41 +02:00

dcache.c

…

dcookies.c

…

direct-io.c

…

drop_caches.c

…

eventfd.c

…

eventpoll.c

epoll: check for events when removing a timed out thread from the wait queue

2022-12-08 11:23:05 +01:00

exec.c

exec: Force single empty string when argv is empty

2022-06-06 08:33:50 +02:00

fcntl.c

…

fhandle.c

…

file_table.c

SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()

2022-05-25 09:14:34 +02:00

file.c

fs: prevent out-of-bounds array speculation when closing a file descriptor

2023-03-17 08:32:47 +01:00

filesystems.c

…

fs_context.c

…

fs_parser.c

…

fs_pin.c

…

fs_struct.c

…

fs_types.c

…

fs-writeback.c

writeback: fix call of incorrect macro

2023-05-17 11:35:58 +02:00

fsopen.c

…

inode.c

fs: fix UAF/GPF bug in nilfs_mdt_destroy

2022-10-15 07:54:36 +02:00

internal.h

…

io_uring.c

io_uring/af_unix: defer registered files gc to io_uring release

2022-10-26 13:22:59 +02:00

ioctl.c

…

Kconfig

…

Kconfig.binfmt

…

libfs.c

libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value

2023-01-18 11:40:55 +01:00

locks.c

…

Makefile

…

mbcache.c

mbcache: Avoid nesting of cache->c_list_lock under bit locks

2023-01-18 11:41:59 +01:00

mount.h

…

mpage.c

…

namei.c

mm: fs: initialize fsdata passed to write_begin/write_end interface

2022-11-25 17:42:22 +01:00

namespace.c

…

no-block.c

…

nsfs.c

…

open.c

…

pipe.c

…

pnode.c

pnode: terminate at peers of source

2023-01-18 11:41:44 +01:00

pnode.h

…

posix_acl.c

…

proc_namespace.c

…

read_write.c

…

readdir.c

…

select.c

…

seq_file.c

…

signalfd.c

io_uring: disable polling pollfree files

2022-09-05 10:27:47 +02:00

splice.c

Revert "fs: check FMODE_LSEEK to control internal pipe splicing"

2022-10-17 17:24:32 +02:00

stack.c

…

stat.c

stat: fix inconsistency between struct stat and struct compat_stat

2022-04-27 13:50:48 +02:00

statfs.c

…

super.c

vfs: make freeze_super abort when sync_filesystem returns error

2022-02-23 11:59:55 +01:00

sync.c

…

timerfd.c

…

userfaultfd.c

userfaultfd: open userfaultfds with O_RDONLY

2022-10-26 13:22:21 +02:00

utimes.c

…

xattr.c

fs: don't audit the capability check in simple_xattr_list()

2023-01-18 11:40:53 +01:00