@@ -299,6 +299,10 @@ static int gfs2_dir_read_data(struct gfs2_inode *ip, __be64 *buf,
goto fail;
BUG_ON(extlen < 1);
bh = gfs2_meta_ra(ip->i_gl, dblock, extlen);
+ if (IS_ERR(bh)) {
+ error = PTR_ERR(bh);
+ goto fail;
+ }
} else {
error = gfs2_meta_read(ip->i_gl, dblock, DIO_WAIT, 0, &bh);
if (error)
@@ -532,7 +532,7 @@ struct buffer_head *gfs2_meta_ra(struct gfs2_glock *gl, u64 dblock, u32 extlen)
first_bh = gfs2_getbuf(gl, dblock, CREATE);
if (buffer_uptodate(first_bh))
- goto out;
+ return first_bh;
bh_read_nowait(first_bh, REQ_META | REQ_PRIO);
dblock++;
@@ -546,11 +546,10 @@ struct buffer_head *gfs2_meta_ra(struct gfs2_glock *gl, u64 dblock, u32 extlen)
dblock++;
extlen--;
if (!buffer_locked(first_bh) && buffer_uptodate(first_bh))
- goto out;
+ return first_bh;
}
wait_on_buffer(first_bh);
-out:
- return first_bh;
+ return buffer_uptodate(first_bh) ? first_bh : ERR_PTR(-EIO);
}
@@ -1427,8 +1427,10 @@ int gfs2_quota_init(struct gfs2_sbd *sdp)
}
error = -EIO;
bh = gfs2_meta_ra(ip->i_gl, dblock, extlen);
- if (!bh)
+ if (IS_ERR(bh)) {
+ error = PTR_ERR(bh);
goto fail;
+ }
if (gfs2_metatype_check(sdp, bh, GFS2_METATYPE_QC))
goto fail_brelse;
@@ -49,7 +49,7 @@ int gfs2_replay_read_block(struct gfs2_jdesc *jd, unsigned int blk,
*bh = gfs2_meta_ra(gl, dblock, extlen);
- return error;
+ return IS_ERR(*bh) ? PTR_ERR(*bh) : 0;
}
int gfs2_revoke_add(struct gfs2_jdesc *jd, u64 blkno, unsigned int where)
Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in gfs2_quota_init+0x22c4/0x2950 gfs2_quota_init+0x22c4/0x2950 gfs2_make_fs_rw+0x4cf/0x6a0 gfs2_fill_super+0x43f5/0x45a0 get_tree_bdev_flags+0x6ee/0x910 get_tree_bdev+0x37/0x50 gfs2_get_tree+0x5c/0x340 vfs_get_tree+0xb3/0x5a0 do_new_mount+0x71f/0x15e0 path_mount+0x742/0x1f10 __se_sys_mount+0x722/0x810 __x64_sys_mount+0xe4/0x150 x64_sys_call+0x39bf/0x3c30 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: __alloc_pages_noprof+0x9a7/0xe00 alloc_pages_mpol_noprof+0x299/0x990 folio_alloc_noprof+0x1db/0x310 filemap_alloc_folio_noprof+0xa6/0x440 __filemap_get_folio+0xac4/0x1550 gfs2_getbuf+0x23f/0xcd0 gfs2_meta_ra+0x17f/0x7b0 gfs2_quota_init+0x78d/0x2950 gfs2_make_fs_rw+0x4cf/0x6a0 gfs2_fill_super+0x43f5/0x45a0 get_tree_bdev_flags+0x6ee/0x910 get_tree_bdev+0x37/0x50 gfs2_get_tree+0x5c/0x340 vfs_get_tree+0xb3/0x5a0 do_new_mount+0x71f/0x15e0 path_mount+0x742/0x1f10 __se_sys_mount+0x722/0x810 __x64_sys_mount+0xe4/0x150 x64_sys_call+0x39bf/0x3c30 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f On a specially crafted filesystem image with invalid on-disk inode data, 'gfs2_meta_ra()' may trigger an attempt to access beyond end of device, and such an attempt is not detected after 'wait_on_buffer()'. Fix this by adding an extra 'buffer_uptodate()' check, throwing -EIO in case of error and adjusting all of the related users. Reported-by: syzbot+9fb37b567267511a9e11@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9fb37b567267511a9e11 Fixes: 7276b3b0c771 ("[GFS2] Tidy up meta_io code") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> --- fs/gfs2/dir.c | 4 ++++ fs/gfs2/meta_io.c | 7 +++---- fs/gfs2/quota.c | 4 +++- fs/gfs2/recovery.c | 2 +- 4 files changed, 11 insertions(+), 6 deletions(-)