linux/fs/ext4
Zhang Yi 33b1bba31f ext4: add reserved GDT blocks check
commit b55c3cd102 upstream.

We capture a NULL pointer issue when resizing a corrupt ext4 image which
is freshly clear resize_inode feature (not run e2fsck). It could be
simply reproduced by following steps. The problem is because of the
resize_inode feature was cleared, and it will convert the filesystem to
meta_bg mode in ext4_resize_fs(), but the es->s_reserved_gdt_blocks was
not reduced to zero, so could we mistakenly call reserve_backup_gdb()
and passing an uninitialized resize_inode to it when adding new group
descriptors.

 mkfs.ext4 /dev/sda 3G
 tune2fs -O ^resize_inode /dev/sda #forget to run requested e2fsck
 mount /dev/sda /mnt
 resize2fs /dev/sda 8G

 ========
 BUG: kernel NULL pointer dereference, address: 0000000000000028
 CPU: 19 PID: 3243 Comm: resize2fs Not tainted 5.18.0-rc7-00001-gfde086c5ebfd #748
 ...
 RIP: 0010:ext4_flex_group_add+0xe08/0x2570
 ...
 Call Trace:
  <TASK>
  ext4_resize_fs+0xbec/0x1660
  __ext4_ioctl+0x1749/0x24e0
  ext4_ioctl+0x12/0x20
  __x64_sys_ioctl+0xa6/0x110
  do_syscall_64+0x3b/0x90
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7f2dd739617b
 ========

The fix is simple, add a check in ext4_resize_begin() to make sure that
the es->s_reserved_gdt_blocks is zero when the resize_inode feature is
disabled.

Cc: stable@kernel.org
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Ritesh Harjani <ritesh.list@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20220601092717.763694-1-yi.zhang@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-22 14:22:05 +02:00
..
.kunitconfig ext4: add .kunitconfig fragment to enable ext4-specific tests 2021-02-11 23:16:30 -05:00
acl.c vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
acl.h vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
balloc.c ext4: flush background discard kwork when retry allocation 2021-08-30 23:35:53 -04:00
bitmap.c
block_validity.c ext4: standardize error message in ext4_protect_reserved_inode() 2020-12-17 13:30:55 -05:00
dir.c ext4: fix potential infinite loop in ext4_dx_readdir() 2021-10-01 00:05:09 -04:00
ext4_extents.h ext4: fix sparse warnings 2021-08-30 23:36:50 -04:00
ext4_jbd2.c ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits' 2022-01-27 11:05:17 +01:00
ext4_jbd2.h ext4: Support for checksumming from journal triggers 2021-08-30 23:36:50 -04:00
ext4.h ext4: only allow test_dummy_encryption when supported 2022-06-09 10:23:31 +02:00
extents_status.c ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit 2021-06-22 21:34:17 -04:00
extents_status.h ext4: fix extent_status trace points 2020-01-25 02:03:03 -05:00
extents.c ext4: fix bug_on in __es_tree_search 2022-06-09 10:23:20 +02:00
fast_commit.c ext4: fast commit may miss file actions 2022-03-08 19:12:32 +01:00
fast_commit.h ext4: simplify updating of fast commit stats 2022-03-08 19:12:32 +01:00
file.c iomap: Add done_before argument to iomap_dio_rw 2022-05-01 17:22:32 +02:00
fsmap.c treewide: Change list_sort to use const pointers 2021-04-08 16:04:22 -07:00
fsmap.h ext4: fsmap: fix the block/inode bitmap comment 2021-06-24 09:48:29 -04:00
fsync.c block: use an on-stack bio in blkdev_issue_flush 2021-01-27 09:51:48 -07:00
hash.c ext4: handle casefolding with encryption 2021-04-05 22:04:20 -04:00
ialloc.c ext4: Support for checksumming from journal triggers 2021-08-30 23:36:50 -04:00
indirect.c ext4: Support for checksumming from journal triggers 2021-08-30 23:36:50 -04:00
inline.c ext4: fix bug_on in ext4_writepages 2022-06-09 10:23:20 +02:00
inode-test.c fs: ext4: Modify inode-test.c to use KUnit parameterized testing feature 2020-12-02 16:07:25 -07:00
inode.c ext4: fix warning in ext4_handle_inode_extension 2022-06-09 10:23:20 +02:00
ioctl.c ext4: fast commit may not fallback for ineligible commit 2022-03-08 19:12:32 +01:00
Kconfig ext: EXT4_KUNIT_TESTS should depend on EXT4_FS instead of selecting it 2021-02-11 23:12:59 -05:00
Makefile ext4: Move orphan inode handling into a separate file 2021-08-30 23:36:51 -04:00
mballoc.c ext4: fix bug_on ext4_mb_use_inode_pa 2022-06-22 14:22:04 +02:00
mballoc.h ext4: fix various seppling typos 2021-04-09 23:14:59 -04:00
migrate.c ext4: don't use the orphan list when migrating an inode 2022-01-27 11:05:18 +01:00
mmp.c ext4: fix potential uninitialized access to retval in kmmpd 2021-07-23 07:31:29 -04:00
move_extent.c ext4: use common helpers in all places reading metadata buffers 2020-10-18 10:37:14 -04:00
namei.c ext4: make variable "count" signed 2022-06-22 14:22:05 +02:00
orphan.c ext4: Improve scalability of ext4 orphan file handling 2021-08-30 23:36:51 -04:00
page-io.c ext4: fix symlink file size not match to file content 2022-04-27 14:39:01 +02:00
readpage.c block: Add bio_max_segs 2021-02-26 15:49:51 -07:00
resize.c ext4: add reserved GDT blocks check 2022-06-22 14:22:05 +02:00
super.c ext4: fix super block checksum incorrect after mount 2022-06-22 14:22:04 +02:00
symlink.c ext4: report correct st_size for encrypted symlinks 2021-07-25 20:01:06 -07:00
sysfs.c ext4: notify sysfs on errors_count value change 2021-06-29 21:06:02 -04:00
truncate.h ext4: Convert to use mapping->invalidate_lock 2021-07-13 14:29:00 +02:00
verity.c New features for ext4 this cycle include support for encrypted 2021-04-30 15:35:30 -07:00
xattr_hurd.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_security.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_trusted.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_user.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr.c ext4: fast commit may not fallback for ineligible commit 2022-03-08 19:12:32 +01:00
xattr.h ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() 2021-06-24 10:09:39 -04:00