David Sterba (1): btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
Dominique Martinet (1): btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()
fs/btrfs/volumes.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://gitee.com/openeuler/kernel/pulls/7714 邮件列表地址：https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6...
FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/7714 Mailing list address: https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6...
From: David Sterba dsterba@suse.com
stable inclusion from stable-v5.4.274 commit 576164bd01bd795f8b09fb194b493103506b33c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIP CVE: CVE-2024-35936
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
[ Upstream commit 7411055db5ce64f836aaffd422396af0075fdc99 ]
The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible conditions:
- at first the search key is set up to look for a chunk tree item, with offset -1, this is an inexact search and the key->offset will contain the correct offset upon a successful search, a valid chunk tree item cannot have an offset -1
- after first successful search, the found_key corresponds to a chunk item, the offset is decremented by 1 before the next loop, it's impossible to find a chunk item there due to alignment and size constraints
Reviewed-by: Josef Bacik josef@toxicpanda.com Reviewed-by: Anand Jain anand.jain@oracle.com Signed-off-by: David Sterba dsterba@suse.com Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Yifan Qiao qiaoyifan4@huawei.com --- fs/btrfs/volumes.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index eaf5cd043dac..634b73d734bc 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -3178,7 +3178,17 @@ static int btrfs_relocate_sys_chunks(struct btrfs_fs_info *fs_info) mutex_unlock(&fs_info->delete_unused_bgs_mutex); goto error; } - BUG_ON(ret == 0); /* Corruption */ + if (ret == 0) { + /* + * On the first search we would find chunk tree with + * offset -1, which is not possible. On subsequent + * loops this would find an existing item on an invalid + * offset (one less than the previous one, wrong + * alignment and size). + */ + ret = -EUCLEAN; + goto error; + }
ret = btrfs_previous_item(chunk_root, path, key.objectid, key.type);
From: Dominique Martinet dominique.martinet@atmark-techno.com
mainline inclusion from mainline-v6.9-rc7 commit 9af503d91298c3f2945e73703f0e00995be08c30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIP CVE: CVE-2024-35936
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
--------------------------------
The previous patch that replaced BUG_ON by error handling forgot to unlock the mutex in the error path.
Link: https://lore.kernel.org/all/Zh%2fHpAGFqa7YAFuM@duo.ucw.cz Reported-by: Pavel Machek pavel@denx.de Fixes: 7411055db5ce ("btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()") CC: stable@vger.kernel.org Reviewed-by: Pavel Machek pavel@denx.de Signed-off-by: Dominique Martinet dominique.martinet@atmark-techno.com Reviewed-by: David Sterba dsterba@suse.com Signed-off-by: David Sterba dsterba@suse.com Conflicts: fs/btrfs/volumes.c [Since commit f33720657d29d6b7282dd2e5e8634e0a39ad372e(btrfs: rename delete_unused_bgs_mutex to reclaim_bgs_lock) renames delete_unused_bgs_mutex to reclaim_bgs_lock and we don't merge this commit because of the conflicts are too much. We use delete_unused_bgs_mutex instead of reclaim_bgs_lock. ] Signed-off-by: Yifan Qiao qiaoyifan@huawei.com --- fs/btrfs/volumes.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index 634b73d734bc..80bde7a23ca3 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -3187,6 +3187,7 @@ static int btrfs_relocate_sys_chunks(struct btrfs_fs_info *fs_info) * alignment and size). */ ret = -EUCLEAN; + mutex_unlock(&fs_info->delete_unused_bgs_mutex); goto error; }
-
patchwork bot -
Yifan Qiao