Zhihao Cheng
a4370c356c
quota: Check next/prev free block number after reading from quota file
commit 6c8ea8b8cd upstream.
Following process:
Init: v2_read_file_info: <3> dqi_free_blk 0 dqi_free_entry 5 dqi_blks 6
Step 1. chown bin f_a -> dquot_acquire -> v2_write_dquot:
qtree_write_dquot
do_insert_tree
find_free_dqentry
get_free_dqblk
write_blk(info->dqi_blocks) // info->dqi_blocks = 6, failure. The
content in physical block (corresponding to blk 6) is random.
Step 2. chown root f_a -> dquot_transfer -> dqput_all -> dqput ->
ext4_release_dquot -> v2_release_dquot -> qtree_delete_dquot:
dquot_release
remove_tree
free_dqentry
put_free_dqblk(6)
info->dqi_free_blk = blk // info->dqi_free_blk = 6
Step 3. drop cache (buffer head for block 6 is released)
Step 4. chown bin f_b -> dquot_acquire -> commit_dqblk -> v2_write_dquot:
qtree_write_dquot
do_insert_tree
find_free_dqentry
get_free_dqblk
dh = (struct qt_disk_dqdbheader *)buf
blk = info->dqi_free_blk // 6
ret = read_blk(info, blk, buf) // The content of buf is random
info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free) // random blk
Step 5. chown bin f_c -> notify_change -> ext4_setattr -> dquot_transfer:
dquot = dqget -> acquire_dquot -> ext4_acquire_dquot -> dquot_acquire ->
commit_dqblk -> v2_write_dquot -> dq_insert_tree:
do_insert_tree
find_free_dqentry
get_free_dqblk
blk = info->dqi_free_blk // If blk < 0 and blk is not an error
code, it will be returned as dquot
transfer_to[USRQUOTA] = dquot // A random negative value
__dquot_transfer(transfer_to)
dquot_add_inodes(transfer_to[cnt])
spin_lock(&dquot->dq_dqb_lock) // page fault
, which will lead to kernel page fault:
Quota error (device sda): qtree_write_dquot: Error -8000 occurred
while creating quota
BUG: unable to handle page fault for address: ffffffffffffe120
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
Oops: 0002 [#1] PREEMPT SMP
CPU: 0 PID: 5974 Comm: chown Not tainted 6.0.0-rc1-00004
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
RIP: 0010:_raw_spin_lock+0x3a/0x90
Call Trace:
dquot_add_inodes+0x28/0x270
__dquot_transfer+0x377/0x840
dquot_transfer+0xde/0x540
ext4_setattr+0x405/0x14d0
notify_change+0x68e/0x9f0
chown_common+0x300/0x430
__x64_sys_fchownat+0x29/0x40
In order to avoid accessing invalid quota memory address, this patch adds
block number checking of next/prev free block read from quota file.
Fetch a reproducer in [Link].
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216372
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
CC: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20220923134555.2623931-2-chengzhihao1@huawei.com
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-10-21 12:37:37 +02:00
..
2022-07-02 18:52:21 +09:00
2022-05-09 16:21:44 -04:00
2022-08-01 19:53:31 +02:00
2022-09-08 08:15:01 -04:00
2022-07-17 17:31:42 -07:00
2022-08-02 12:34:03 -04:00
2022-05-09 16:21:44 -04:00
2022-09-20 10:23:24 -07:00
2022-08-31 16:41:10 +01:00
2022-08-11 12:41:07 -07:00
2022-10-21 12:37:34 +02:00
2022-08-02 12:34:03 -04:00
2022-02-22 18:30:28 +01:00
2022-08-02 12:34:02 -04:00
2022-08-11 12:41:07 -07:00
2022-09-05 13:02:34 +02:00
2022-01-24 14:17:02 +01:00
2022-10-21 12:37:37 +02:00
2022-05-09 16:21:45 -04:00
2022-06-24 20:40:19 +02:00
2022-05-09 16:21:45 -04:00
2022-09-05 23:23:30 +08:00
2022-09-04 09:38:40 +09:00
2022-04-28 16:31:10 +02:00
2022-08-05 16:32:45 -07:00
2022-09-26 13:21:05 -04:00
2022-08-08 11:18:31 -07:00
2022-08-07 10:03:24 -07:00
2022-08-02 12:34:03 -04:00
2022-08-09 14:13:59 +01:00
2022-08-08 20:04:35 -07:00
2022-08-11 13:11:49 -07:00
2022-06-29 08:51:06 -04:00
2022-08-03 10:35:43 -07:00
2022-08-02 12:34:02 -04:00
2022-05-09 16:21:45 -04:00
2022-08-08 20:04:35 -07:00
2022-08-11 13:11:49 -07:00
2022-07-14 12:14:32 -06:00
2022-08-05 16:32:45 -07:00
2022-06-03 14:42:24 -07:00
2022-08-03 10:35:43 -07:00
2022-07-28 10:57:25 +02:00
2022-08-15 21:07:01 -05:00
2022-08-04 10:28:48 -04:00
2022-05-09 16:21:44 -04:00
2022-07-14 10:10:12 +02:00
2022-09-12 17:53:46 -04:00
2022-09-13 15:11:38 +02:00
2022-10-15 08:02:54 +02:00
2022-07-26 13:38:47 +02:00
2022-09-11 16:22:29 -07:00
2022-08-22 11:33:02 -07:00
2022-08-28 14:02:45 -07:00
2022-05-09 16:21:44 -04:00
2022-03-22 15:57:03 -07:00
2022-06-29 08:51:07 -04:00
2022-08-17 11:23:31 +02:00
2022-08-20 15:17:45 -07:00
2022-09-30 08:16:06 -07:00
2022-05-09 16:21:44 -04:00
2022-05-09 16:21:44 -04:00
2022-10-21 12:37:37 +02:00
2022-08-03 10:35:43 -07:00
2022-05-09 16:21:46 -04:00
2022-05-23 20:24:12 -05:00
2022-08-28 14:02:45 -07:00
2022-04-05 15:39:19 +02:00
2022-05-27 11:22:03 -07:00
2022-09-08 17:10:54 -04:00
2022-08-05 16:32:45 -07:00
2022-07-14 12:14:32 -06:00
2022-08-03 10:35:43 -07:00
2022-02-14 10:37:32 +09:00
2022-05-09 16:21:46 -04:00
2022-07-15 23:42:30 -07:00
2022-09-11 16:22:29 -07:00
2022-08-11 13:11:49 -07:00
2022-08-03 13:50:22 -07:00
2022-08-08 10:39:29 -07:00
2022-03-08 12:55:29 -06:00
2022-03-03 20:38:56 -08:00
2022-04-15 14:49:56 -07:00
2022-04-22 10:57:18 -07:00
2022-02-09 09:50:02 -08:00
2022-08-03 10:35:43 -07:00
2022-03-03 20:38:56 -08:00
2022-10-12 09:39:04 +02:00
2022-09-24 18:14:12 -07:00
2022-08-17 14:33:03 -07:00
2022-08-08 22:37:22 -04:00
2022-07-17 17:31:40 -07:00
2022-09-13 10:38:43 -07:00
2022-06-10 16:10:23 -04:00
2022-08-03 13:50:22 -07:00
2022-06-05 15:03:03 -04:00
2022-01-18 09:23:19 +02:00
2022-08-28 14:02:43 -07:00
2022-05-19 23:25:10 -04:00
2022-10-12 09:39:03 +02:00
2022-09-28 14:28:40 -04:00
2022-04-01 19:35:56 -07:00
2022-08-08 18:06:42 -07:00
2022-05-30 10:56:18 -07:00
2022-06-16 19:58:21 -07:00
2022-05-09 16:21:44 -04:00
2022-08-17 15:08:58 -04:00
2022-07-24 18:39:10 -06:00
2022-10-21 12:37:37 +02:00
2022-07-05 16:18:21 -04:00
2022-08-03 10:35:43 -07:00
2022-08-09 09:52:28 -07:00
2022-08-17 11:27:11 +02:00
2022-09-20 11:57:57 +02:00
2022-05-27 11:22:03 -07:00
2022-08-17 11:23:31 +02:00
2022-06-28 13:58:05 -04:00
2022-09-28 14:28:40 -04:00
2022-08-05 16:32:45 -07:00
2022-01-11 09:03:05 -08:00
2022-05-22 21:03:01 +01:00
2022-01-17 05:49:30 +02:00
2022-08-08 22:37:23 -04:00
2022-05-31 14:10:54 -07:00
2022-08-08 11:10:02 -07:00
2022-04-26 13:36:25 -07:00
2022-01-22 08:33:36 +02:00
2022-08-20 15:17:45 -07:00
2022-07-15 22:08:59 +02:00