mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
synced 2025-08-26 21:52:20 +00:00

[ Syzkaller Report ] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000087: 0000 [#1 KASAN: null-ptr-deref in range [0x0000000000000438-0x000000000000043f] CPU: 2 UID: 0 PID: 10614 Comm: syz-executor.0 Not tainted 6.13.0-rc6-gfbfd64d25c7a-dirty #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Sched_ext: serialise (enabled+all), task: runnable_at=-30ms RIP: 0010:jfs_ioc_trim+0x34b/0x8f0 Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93 90 82 fe ff 4c 89 ff 31 f6 RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206 RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001 RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000 R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438 FS: 00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die_body+0x61/0xb0 ? die_addr+0xb1/0xe0 ? exc_general_protection+0x333/0x510 ? asm_exc_general_protection+0x26/0x30 ? jfs_ioc_trim+0x34b/0x8f0 jfs_ioctl+0x3c8/0x4f0 ? __pfx_jfs_ioctl+0x10/0x10 ? __pfx_jfs_ioctl+0x10/0x10 __se_sys_ioctl+0x269/0x350 ? __pfx___se_sys_ioctl+0x10/0x10 ? do_syscall_64+0xfb/0x210 do_syscall_64+0xee/0x210 ? syscall_exit_to_user_mode+0x1e0/0x330 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe51f4903ad Code: c3 e8 a7 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d RSP: 002b:00007fe5202250c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fe51f5cbf80 RCX: 00007fe51f4903ad RDX: 0000000020000680 RSI: 00000000c0185879 RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe520225640 R13: 000000000000000e R14: 00007fe51f44fca0 R15: 00007fe52021d000 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:jfs_ioc_trim+0x34b/0x8f0 Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93 90 82 fe ff 4c 89 ff 31 f6 RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206 RAX: 0000000000000087 RBX: 00005866a9e67ff8 RCX: 000000000000000a RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000001 RBP: dffffc0000000000 R08: ffff88807c180003 R09: 1ffff1100f830000 R10: dffffc0000000000 R11: ffffed100f830001 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000438 FS: 00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005593c91b2c88 CR3: 000000014927c000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Kernel panic - not syncing: Fatal exception [ Analysis ] We believe that we have found a concurrency bug in the `fs/jfs` module that results in a null pointer dereference. There is a closely related issue which has been fixed: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234 ... but, unfortunately, the accepted patch appears to still be susceptible to a null pointer dereference under some interleavings. To trigger the bug, we think that `JFS_SBI(ipbmap->i_sb)->bmap` is set to NULL in `dbFreeBits` and then dereferenced in `jfs_ioc_trim`. This bug manifests quite rarely under normal circumstances, but is triggereable from a syz-program. Reported-and-tested-by: Dylan J. Wolff<wolffd@comp.nus.edu.sg> Reported-and-tested-by: Jiacheng Xu <stitch@zju.edu.cn> Signed-off-by: Dylan J. Wolff<wolffd@comp.nus.edu.sg> Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
115 lines
2.6 KiB
C
115 lines
2.6 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* Copyright (C) Tino Reichardt, 2012
|
|
*/
|
|
|
|
#include <linux/fs.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/blkdev.h>
|
|
|
|
#include "jfs_incore.h"
|
|
#include "jfs_superblock.h"
|
|
#include "jfs_discard.h"
|
|
#include "jfs_dmap.h"
|
|
#include "jfs_debug.h"
|
|
|
|
|
|
/*
|
|
* NAME: jfs_issue_discard()
|
|
*
|
|
* FUNCTION: TRIM the specified block range on device, if supported
|
|
*
|
|
* PARAMETERS:
|
|
* ip - pointer to in-core inode
|
|
* blkno - starting block number to be trimmed (0..N)
|
|
* nblocks - number of blocks to be trimmed
|
|
*
|
|
* RETURN VALUES:
|
|
* none
|
|
*
|
|
* serialization: IREAD_LOCK(ipbmap) held on entry/exit;
|
|
*/
|
|
void jfs_issue_discard(struct inode *ip, u64 blkno, u64 nblocks)
|
|
{
|
|
struct super_block *sb = ip->i_sb;
|
|
int r = 0;
|
|
|
|
r = sb_issue_discard(sb, blkno, nblocks, GFP_NOFS, 0);
|
|
if (unlikely(r != 0)) {
|
|
jfs_err("JFS: sb_issue_discard(%p, %llu, %llu, GFP_NOFS, 0) = %d => failed!",
|
|
sb, (unsigned long long)blkno,
|
|
(unsigned long long)nblocks, r);
|
|
}
|
|
|
|
jfs_info("JFS: sb_issue_discard(%p, %llu, %llu, GFP_NOFS, 0) = %d",
|
|
sb, (unsigned long long)blkno,
|
|
(unsigned long long)nblocks, r);
|
|
|
|
return;
|
|
}
|
|
|
|
/*
|
|
* NAME: jfs_ioc_trim()
|
|
*
|
|
* FUNCTION: attempt to discard (TRIM) all free blocks from the
|
|
* filesystem.
|
|
*
|
|
* PARAMETERS:
|
|
* ip - pointer to in-core inode;
|
|
* range - the range, given by user space
|
|
*
|
|
* RETURN VALUES:
|
|
* 0 - success
|
|
* -EIO - i/o error
|
|
*/
|
|
int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)
|
|
{
|
|
struct inode *ipbmap = JFS_SBI(ip->i_sb)->ipbmap;
|
|
struct bmap *bmp;
|
|
struct super_block *sb = ipbmap->i_sb;
|
|
int agno, agno_end;
|
|
u64 start, end, minlen;
|
|
u64 trimmed = 0;
|
|
|
|
/**
|
|
* convert byte values to block size of filesystem:
|
|
* start: First Byte to trim
|
|
* len: number of Bytes to trim from start
|
|
* minlen: minimum extent length in Bytes
|
|
*/
|
|
start = range->start >> sb->s_blocksize_bits;
|
|
end = start + (range->len >> sb->s_blocksize_bits) - 1;
|
|
minlen = range->minlen >> sb->s_blocksize_bits;
|
|
if (minlen == 0)
|
|
minlen = 1;
|
|
|
|
down_read(&sb->s_umount);
|
|
bmp = JFS_SBI(ip->i_sb)->bmap;
|
|
|
|
if (bmp == NULL ||
|
|
minlen > bmp->db_agsize ||
|
|
start >= bmp->db_mapsize ||
|
|
range->len < sb->s_blocksize) {
|
|
up_read(&sb->s_umount);
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (end >= bmp->db_mapsize)
|
|
end = bmp->db_mapsize - 1;
|
|
|
|
/**
|
|
* we trim all ag's within the range
|
|
*/
|
|
agno = BLKTOAG(start, JFS_SBI(ip->i_sb));
|
|
agno_end = BLKTOAG(end, JFS_SBI(ip->i_sb));
|
|
while (agno <= agno_end) {
|
|
trimmed += dbDiscardAG(ip, agno, minlen);
|
|
agno++;
|
|
}
|
|
|
|
up_read(&sb->s_umount);
|
|
range->len = trimmed << sb->s_blocksize_bits;
|
|
|
|
return 0;
|
|
}
|