<div dir="ltr"><div>Applied to bionic/linux master-next</div><div><br></div><div>Thanks!</div><div><br></div><div>- Luke<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, May 9, 2022 at 7:01 AM Paolo Pisati <<a href="mailto:paolo.pisati@canonical.com">paolo.pisati@canonical.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">From: Tadeusz Struk <<a href="mailto:tadeusz.struk@linaro.org" target="_blank">tadeusz.struk@linaro.org</a>><br>
<br>
BugLink: <a href="https://bugs.launchpad.net/bugs/196947" rel="noreferrer" target="_blank">https://bugs.launchpad.net/bugs/196947</a><br>
<br>
Syzbot found an issue [1] in ext4_fallocate().<br>
The C reproducer [2] calls fallocate(), passing size 0xffeffeff000ul,<br>
and offset 0x1000000ul, which, when added together exceed the<br>
bitmap_maxbytes for the inode. This triggers a BUG in<br>
ext4_ind_remove_space(). According to the comments in this function<br>
the 'end' parameter needs to be one block after the last block to be<br>
removed. In the case when the BUG is triggered it points to the last<br>
block. Modify the ext4_punch_hole() function and add constraint that<br>
caps the length to satisfy the one before laster block requirement.<br>
<br>
LINK: [1] <a href="https://syzkaller.appspot.com/bug?id=b80bd9cf348aac724a4f4dff251800106d721331" rel="noreferrer" target="_blank">https://syzkaller.appspot.com/bug?id=b80bd9cf348aac724a4f4dff251800106d721331</a><br>
LINK: [2] <a href="https://syzkaller.appspot.com/text?tag=ReproC&x=14ba0238700000" rel="noreferrer" target="_blank">https://syzkaller.appspot.com/text?tag=ReproC&x=14ba0238700000</a><br>
<br>
Fixes: a4bb6b64e39a ("ext4: enable "punch hole" functionality")<br>
Reported-by: <a href="mailto:syzbot%2B7a806094edd5d07ba029@syzkaller.appspotmail.com" target="_blank">syzbot+7a806094edd5d07ba029@syzkaller.appspotmail.com</a><br>
Signed-off-by: Tadeusz Struk <<a href="mailto:tadeusz.struk@linaro.org" target="_blank">tadeusz.struk@linaro.org</a>><br>
Link: <a href="https://lore.kernel.org/r/20220331200515.153214-1-tadeusz.struk@linaro.org" rel="noreferrer" target="_blank">https://lore.kernel.org/r/20220331200515.153214-1-tadeusz.struk@linaro.org</a><br>
Signed-off-by: Theodore Ts'o <<a href="mailto:tytso@mit.edu" target="_blank">tytso@mit.edu</a>><br>
Cc: <a href="mailto:stable@kernel.org" target="_blank">stable@kernel.org</a><br>
(cherry picked from commit 2da376228a2427501feb9d15815a45dbdbdd753e)<br>
Reported-by: Colin King <<a href="mailto:colin.i.king@gmail.com" target="_blank">colin.i.king@gmail.com</a>><br>
Signed-off-by: Paolo Pisati <<a href="mailto:paolo.pisati@canonical.com" target="_blank">paolo.pisati@canonical.com</a>><br>
---<br>
fs/ext4/inode.c | 11 ++++++++++-<br>
1 file changed, 10 insertions(+), 1 deletion(-)<br>
<br>
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c<br>
index 54d8bdd46b9f..d22b2a522ef1 100644<br>
--- a/fs/ext4/inode.c<br>
+++ b/fs/ext4/inode.c<br>
@@ -4314,7 +4314,8 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)<br>
struct super_block *sb = inode->i_sb;<br>
ext4_lblk_t first_block, stop_block;<br>
struct address_space *mapping = inode->i_mapping;<br>
- loff_t first_block_offset, last_block_offset;<br>
+ loff_t first_block_offset, last_block_offset, max_length;<br>
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);<br>
handle_t *handle;<br>
unsigned int credits;<br>
int ret = 0;<br>
@@ -4360,6 +4361,14 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)<br>
offset;<br>
}<br>
<br>
+ /*<br>
+ * For punch hole the length + offset needs to be within one block<br>
+ * before last range. Adjust the length if it goes beyond that limit.<br>
+ */<br>
+ max_length = sbi->s_bitmap_maxbytes - inode->i_sb->s_blocksize;<br>
+ if (offset + length > max_length)<br>
+ length = max_length - offset;<br>
+<br>
if (offset & (sb->s_blocksize - 1) ||<br>
(offset + length) & (sb->s_blocksize - 1)) {<br>
/*<br>
-- <br>
2.25.1<br>
<br>
<br>
-- <br>
kernel-team mailing list<br>
<a href="mailto:kernel-team@lists.ubuntu.com" target="_blank">kernel-team@lists.ubuntu.com</a><br>
<a href="https://lists.ubuntu.com/mailman/listinfo/kernel-team" rel="noreferrer" target="_blank">https://lists.ubuntu.com/mailman/listinfo/kernel-team</a><br>
</blockquote></div></div>