From patchwork Fri Nov 29 09:03:54 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Antipov X-Patchwork-Id: 13888526 Received: from forward103b.mail.yandex.net (forward103b.mail.yandex.net [178.154.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D6CF16A92E for ; Fri, 29 Nov 2024 09:18:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.150 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732871922; cv=none; b=Y+FeRNRe3dfiF/J/UAqelPl7P655jpvposf5L7ab71/k4xS8VWHAwRfUFropPwXzkM+lKZq6j75mgbs9Tl1Jucs+dL8mQ3OJxtQRo7MJadW5TZzlUl/JUZWR3NRxsMvLnYg2Yt4H/JBByY3nX/lDMV8m45nJbYiJwkYySaQzUj8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732871922; c=relaxed/simple; bh=Y8aEBPbd5DgLbGNrhcKnY3kzlL+4aXBL2AZzYx1CWfM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YW7q6tWsdxc8wHk8NuwITM08l4d7LcZ6Ub+XlfDhR3CJlna7Ta0d79occCdgzSIcfnENflVzDHE0nyYKq2AQjNaE7Uux+okb0cfnipvsdEbF3zGeGiVM0k9YzF7Sh05caYBdWvlF2qdsLIC4PMpC1waNzypAdBgZRCkW6/ViO1g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru; spf=pass smtp.mailfrom=yandex.ru; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b=lYx6s+0F; arc=none smtp.client-ip=178.154.239.150 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b="lYx6s+0F" Received: from mail-nwsmtp-smtp-production-main-46.sas.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-46.sas.yp-c.yandex.net [IPv6:2a02:6b8:c07:109:0:640:efe1:0]) by forward103b.mail.yandex.net (Yandex) with ESMTPS id 3E88A608F1; Fri, 29 Nov 2024 12:18:31 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-46.sas.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id SIX747HOl0U0-5hvnaODk; Fri, 29 Nov 2024 12:18:30 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1732871910; bh=kdFdHuC1AqlBdX5CGc+aFd6jDW3DJKCLcSvuBGlpCH0=; h=Message-ID:Date:Cc:Subject:To:From; b=lYx6s+0FBs+4JqO2TXjZfMfZ2FjGa4UgrZgCxoM/bgci7oCDLrwoeFktlbmGmzyQ1 RQpb4sir7GvTSZc3WhkgljErIoOtOPyr0Wkjii1M+EVX7z41moEWQznV2EmOndfWPf y7CU0XFBHtThi3IbsXYzxBc2/yLAoF+m+GsEJvyI= Authentication-Results: mail-nwsmtp-smtp-production-main-46.sas.yp-c.yandex.net; dkim=pass header.i=@yandex.ru From: Dmitry Antipov To: Andreas Gruenbacher Cc: Steven Whitehouse , gfs2@lists.linux.dev, linux-fsdevel@vger.kernel.org, lvc-project@linuxtesting.org, Dmitry Antipov , syzbot+9fb37b567267511a9e11@syzkaller.appspotmail.com Subject: [PATCH 1/2] gfs2: throw -EIO when attempting to access beyond end of device Date: Fri, 29 Nov 2024 12:03:54 +0300 Message-ID: <20241129090355.365972-1-dmantipov@yandex.ru> X-Mailer: git-send-email 2.47.1 Precedence: bulk X-Mailing-List: linux-fsdevel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in gfs2_quota_init+0x22c4/0x2950 gfs2_quota_init+0x22c4/0x2950 gfs2_make_fs_rw+0x4cf/0x6a0 gfs2_fill_super+0x43f5/0x45a0 get_tree_bdev_flags+0x6ee/0x910 get_tree_bdev+0x37/0x50 gfs2_get_tree+0x5c/0x340 vfs_get_tree+0xb3/0x5a0 do_new_mount+0x71f/0x15e0 path_mount+0x742/0x1f10 __se_sys_mount+0x722/0x810 __x64_sys_mount+0xe4/0x150 x64_sys_call+0x39bf/0x3c30 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: __alloc_pages_noprof+0x9a7/0xe00 alloc_pages_mpol_noprof+0x299/0x990 folio_alloc_noprof+0x1db/0x310 filemap_alloc_folio_noprof+0xa6/0x440 __filemap_get_folio+0xac4/0x1550 gfs2_getbuf+0x23f/0xcd0 gfs2_meta_ra+0x17f/0x7b0 gfs2_quota_init+0x78d/0x2950 gfs2_make_fs_rw+0x4cf/0x6a0 gfs2_fill_super+0x43f5/0x45a0 get_tree_bdev_flags+0x6ee/0x910 get_tree_bdev+0x37/0x50 gfs2_get_tree+0x5c/0x340 vfs_get_tree+0xb3/0x5a0 do_new_mount+0x71f/0x15e0 path_mount+0x742/0x1f10 __se_sys_mount+0x722/0x810 __x64_sys_mount+0xe4/0x150 x64_sys_call+0x39bf/0x3c30 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f On a specially crafted filesystem image with invalid on-disk inode data, 'gfs2_meta_ra()' may trigger an attempt to access beyond end of device, and such an attempt is not detected after 'wait_on_buffer()'. Fix this by adding an extra 'buffer_uptodate()' check, throwing -EIO in case of error and adjusting all of the related users. Reported-by: syzbot+9fb37b567267511a9e11@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9fb37b567267511a9e11 Fixes: 7276b3b0c771 ("[GFS2] Tidy up meta_io code") Signed-off-by: Dmitry Antipov --- fs/gfs2/dir.c | 4 ++++ fs/gfs2/meta_io.c | 7 +++---- fs/gfs2/quota.c | 4 +++- fs/gfs2/recovery.c | 2 +- 4 files changed, 11 insertions(+), 6 deletions(-) diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c index dbf1aede744c..85736135bcf5 100644 --- a/fs/gfs2/dir.c +++ b/fs/gfs2/dir.c @@ -299,6 +299,10 @@ static int gfs2_dir_read_data(struct gfs2_inode *ip, __be64 *buf, goto fail; BUG_ON(extlen < 1); bh = gfs2_meta_ra(ip->i_gl, dblock, extlen); + if (IS_ERR(bh)) { + error = PTR_ERR(bh); + goto fail; + } } else { error = gfs2_meta_read(ip->i_gl, dblock, DIO_WAIT, 0, &bh); if (error) diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c index fea3efcc2f93..18957afed91a 100644 --- a/fs/gfs2/meta_io.c +++ b/fs/gfs2/meta_io.c @@ -532,7 +532,7 @@ struct buffer_head *gfs2_meta_ra(struct gfs2_glock *gl, u64 dblock, u32 extlen) first_bh = gfs2_getbuf(gl, dblock, CREATE); if (buffer_uptodate(first_bh)) - goto out; + return first_bh; bh_read_nowait(first_bh, REQ_META | REQ_PRIO); dblock++; @@ -546,11 +546,10 @@ struct buffer_head *gfs2_meta_ra(struct gfs2_glock *gl, u64 dblock, u32 extlen) dblock++; extlen--; if (!buffer_locked(first_bh) && buffer_uptodate(first_bh)) - goto out; + return first_bh; } wait_on_buffer(first_bh); -out: - return first_bh; + return buffer_uptodate(first_bh) ? first_bh : ERR_PTR(-EIO); } diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c index 72b48f6f5561..d919edfb8dda 100644 --- a/fs/gfs2/quota.c +++ b/fs/gfs2/quota.c @@ -1427,8 +1427,10 @@ int gfs2_quota_init(struct gfs2_sbd *sdp) } error = -EIO; bh = gfs2_meta_ra(ip->i_gl, dblock, extlen); - if (!bh) + if (IS_ERR(bh)) { + error = PTR_ERR(bh); goto fail; + } if (gfs2_metatype_check(sdp, bh, GFS2_METATYPE_QC)) goto fail_brelse; diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c index f4fe7039f725..527353c36aa5 100644 --- a/fs/gfs2/recovery.c +++ b/fs/gfs2/recovery.c @@ -49,7 +49,7 @@ int gfs2_replay_read_block(struct gfs2_jdesc *jd, unsigned int blk, *bh = gfs2_meta_ra(gl, dblock, extlen); - return error; + return IS_ERR(*bh) ? PTR_ERR(*bh) : 0; } int gfs2_revoke_add(struct gfs2_jdesc *jd, u64 blkno, unsigned int where) From patchwork Fri Nov 29 09:03:55 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Antipov X-Patchwork-Id: 13888527 Received: from forward101b.mail.yandex.net (forward101b.mail.yandex.net [178.154.239.148]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A2570170A15 for ; Fri, 29 Nov 2024 09:18:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.148 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732871923; cv=none; b=pKbnDaMV24JSmbAswFYjkUWVQ0sLvgyeUkO+H8dUNOBsuMR/GErN6B7spmInQkVkkuFYpbUkL0oIK5kYexU5iPBzd2JWbLq2CnMXJaNKjO6Bwy8dRm99rZmj7Y3vLW/C6oU83slYP2sLEAVGusSFZSP1seqIqcng0zD0/Bqf6U4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1732871923; c=relaxed/simple; bh=6Ofjd3lsBtR9sLdqVHv2uq0QaDdVeE4LdyhtDMLUz+Y=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LBuqmJ5bzaoJxckefWFBTp4uEE1PIeRGuvfRuSePPGfuwV286Wb4gG48ZIKtBxFF7FcbGJ3DEg4EAOOZOd35i9h1BxkAnYnsKMIiOR5GsFl6LbgsrFbmljXqySFI18zgbUyR/LYiE9gbLkk05LgeKuUNjlqU+BdTtEm5Ugup760= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru; spf=pass smtp.mailfrom=yandex.ru; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b=YFWw5uDm; arc=none smtp.client-ip=178.154.239.148 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b="YFWw5uDm" Received: from mail-nwsmtp-smtp-production-main-46.sas.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-46.sas.yp-c.yandex.net [IPv6:2a02:6b8:c07:109:0:640:efe1:0]) by forward101b.mail.yandex.net (Yandex) with ESMTPS id F26E060E18; Fri, 29 Nov 2024 12:18:31 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-46.sas.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id SIX747HOl0U0-puwfVSDK; Fri, 29 Nov 2024 12:18:31 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1732871911; bh=ot2jlcBchNY/FjHrqVluTtlM6+/wbytJf+Jwus3KUAE=; h=Message-ID:Date:In-Reply-To:Cc:Subject:References:To:From; b=YFWw5uDmbvD03YHhHgXqjOBUiW9wz93xesWOwJpSNjWUPMPtTL+1I7CMuf5bo34W3 BTrGLw3r32O1IU+8bRyPGtTVdbhPNs+RNu8PiGjWXUzi+008H64DOtJ34hPQEYZ2NL TGczrmaO5i21wAIJ9ubfsbvFrPiHkzjbsfJFsy74= Authentication-Results: mail-nwsmtp-smtp-production-main-46.sas.yp-c.yandex.net; dkim=pass header.i=@yandex.ru From: Dmitry Antipov To: Andreas Gruenbacher Cc: Steven Whitehouse , gfs2@lists.linux.dev, linux-fsdevel@vger.kernel.org, lvc-project@linuxtesting.org, Dmitry Antipov Subject: [PATCH 2/2] gfs2: miscellaneous spelling fixes Date: Fri, 29 Nov 2024 12:03:55 +0300 Message-ID: <20241129090355.365972-2-dmantipov@yandex.ru> X-Mailer: git-send-email 2.47.1 In-Reply-To: <20241129090355.365972-1-dmantipov@yandex.ru> References: <20241129090355.365972-1-dmantipov@yandex.ru> Precedence: bulk X-Mailing-List: linux-fsdevel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Fix spelling here and there as suggested by codespell. Signed-off-by: Dmitry Antipov --- fs/gfs2/bmap.c | 2 +- fs/gfs2/dir.c | 2 +- fs/gfs2/lock_dlm.c | 4 ++-- fs/gfs2/quota.c | 2 +- fs/gfs2/recovery.c | 2 +- fs/gfs2/rgrp.c | 4 ++-- fs/gfs2/trace_gfs2.h | 2 +- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c index 1795c4e8dbf6..100784403758 100644 --- a/fs/gfs2/bmap.c +++ b/fs/gfs2/bmap.c @@ -1194,7 +1194,7 @@ const struct iomap_ops gfs2_iomap_ops = { * @inode: The inode * @lblock: The logical block number * @bh_map: The bh to be mapped - * @create: True if its ok to alloc blocks to satify the request + * @create: True if its ok to alloc blocks to satisfy the request * * The size of the requested mapping is defined in bh_map->b_size. * diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c index 85736135bcf5..dc5879e055ab 100644 --- a/fs/gfs2/dir.c +++ b/fs/gfs2/dir.c @@ -1259,7 +1259,7 @@ static int compare_dents(const void *a, const void *b) * @sort_start: index of the directory array to start our sort * @copied: pointer to int that's non-zero if a entry has been copied out * - * Jump through some hoops to make sure that if there are hash collsions, + * Jump through some hoops to make sure that if there are hash collisions, * they are read out at the beginning of a buffer. We want to minimize * the possibility that they will fall into different readdir buffers or * that someone will want to seek to that location. diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c index 58aeeae7ed8c..e8099e293212 100644 --- a/fs/gfs2/lock_dlm.c +++ b/fs/gfs2/lock_dlm.c @@ -425,7 +425,7 @@ static void gdlm_cancel(struct gfs2_glock *gl) * 10. gfs2_control sets control_lock lvb = new gen + bits for failed jids * 12. gfs2_recover does journal recoveries for failed jids identified above * 14. gfs2_control clears control_lock lvb bits for recovered jids - * 15. gfs2_control checks if recover_block == recover_start (step 3 occured + * 15. gfs2_control checks if recover_block == recover_start (step 3 occurred * again) then do nothing, otherwise if recover_start > recover_block * then clear BLOCK_LOCKS. * @@ -823,7 +823,7 @@ static void gfs2_control_func(struct work_struct *work) /* * No more jid bits set in lvb, all recovery is done, unblock locks - * (unless a new recover_prep callback has occured blocking locks + * (unless a new recover_prep callback has occurred blocking locks * again while working above) */ diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c index d919edfb8dda..2989f5f3295e 100644 --- a/fs/gfs2/quota.c +++ b/fs/gfs2/quota.c @@ -11,7 +11,7 @@ * avoids the bottleneck of constantly touching the quota file, but introduces * fuzziness in the current usage value of IDs that are being used on different * nodes in the cluster simultaneously. So, it is possible for a user on - * multiple nodes to overrun their quota, but that overrun is controlable. + * multiple nodes to overrun their quota, but that overrun is controllable. * Since quota tags are part of transactions, there is no need for a quota check * program to be run on node crashes or anything like that. * diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c index 527353c36aa5..779db78f9c80 100644 --- a/fs/gfs2/recovery.c +++ b/fs/gfs2/recovery.c @@ -154,7 +154,7 @@ int __get_log_header(struct gfs2_sbd *sdp, const struct gfs2_log_header *lh, * @blk: the block to look at * @head: the log header to return * - * Read the log header for a given segement in a given journal. Do a few + * Read the log header for a given segment in a given journal. Do a few * sanity checks on it. * * Returns: 0 on success, diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index b14e54b38ee8..a0aec705c5ee 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -1028,7 +1028,7 @@ static int gfs2_ri_update(struct gfs2_inode *ip) * special file, which might have been updated if someone expanded the * filesystem (via gfs2_grow utility), which adds new resource groups. * - * Returns: 0 on succeess, error code otherwise + * Returns: 0 on success, error code otherwise */ int gfs2_rindex_update(struct gfs2_sbd *sdp) @@ -1912,7 +1912,7 @@ static void try_rgrp_unlink(struct gfs2_rgrpd *rgd, u64 *last_unlinked, u64 skip * the lock for this rgrp's glock is significantly greater than the * time taken for resource groups on average. We introduce a margin in * the form of the variable @var which is computed as the sum of the two - * respective variences, and multiplied by a factor depending on @loops + * respective variances, and multiplied by a factor depending on @loops * and whether we have a lot of data to base the decision on. This is * then tested against the square difference of the means in order to * decide whether the result is statistically significant or not. diff --git a/fs/gfs2/trace_gfs2.h b/fs/gfs2/trace_gfs2.h index 8eae8d62a413..04535e07d090 100644 --- a/fs/gfs2/trace_gfs2.h +++ b/fs/gfs2/trace_gfs2.h @@ -429,7 +429,7 @@ TRACE_EVENT(gfs2_ail_flush, * Objectives: * Latency: Bmap request time * Performance: Block allocator tracing - * Correctness: Test of disard generation vs. blocks allocated + * Correctness: Test of discard generation vs. blocks allocated */ /* Map an extent of blocks, possibly a new allocation */