Skip to content
Snippets Groups Projects
Select Git revision
  • 6c27d754cb5c2c3044a50d92c4d09a85004bf452
  • openEuler-1.0-LTS default protected
  • openEuler-22.09
  • OLK-5.10
  • openEuler-22.03-LTS
  • openEuler-22.03-LTS-Ascend
  • master
  • openEuler-22.03-LTS-LoongArch-NW
  • openEuler-22.09-HCK
  • openEuler-20.03-LTS-SP3
  • openEuler-21.09
  • openEuler-21.03
  • openEuler-20.09
  • 4.19.90-2210.5.0
  • 5.10.0-123.0.0
  • 5.10.0-60.63.0
  • 5.10.0-60.62.0
  • 4.19.90-2210.4.0
  • 5.10.0-121.0.0
  • 5.10.0-60.61.0
  • 4.19.90-2210.3.0
  • 5.10.0-60.60.0
  • 5.10.0-120.0.0
  • 5.10.0-60.59.0
  • 5.10.0-119.0.0
  • 4.19.90-2210.2.0
  • 4.19.90-2210.1.0
  • 5.10.0-118.0.0
  • 5.10.0-106.19.0
  • 5.10.0-60.58.0
  • 4.19.90-2209.6.0
  • 5.10.0-106.18.0
  • 5.10.0-106.17.0
33 results

22b970264

  • Clone with SSH
  • Clone with HTTPS
  • user avatar
    Zhihao Cheng authored and Yongqiang Liu committed
    hulk inclusion
    category: bugfix
    bugzilla: 187046, https://gitee.com/openeuler/kernel/issues/I5QH0X
    CVE: NA
    
    --------------------------------
    
    Following process:
     Init: v2_read_file_info: <3> dqi_free_blk 0 dqi_free_entry 5 dqi_blks 6
    
     Step 1. chown bin f_a -> dquot_acquire -> v2_write_dquot:
      qtree_write_dquot
       do_insert_tree
        find_free_dqentry
         get_free_dqblk
          write_blk(info->dqi_blocks) // info->dqi_blocks = 6, failure. The
    	   content in physical block (corresponding to blk 6) is random.
    
     Step 2. chown root f_a -> dquot_transfer -> dqput_all -> dqput ->
             ext4_release_dquot -> v2_release_dquot -> qtree_delete_dquot:
      dquot_release
       remove_tree
        free_dqentry
         put_free_dqblk(6)
          info->dqi_free_blk = blk    // info->dqi_free_blk = 6
    
     Step 3. drop cache (buffer head for block 6 is released)
    
     Step 4. chown bin f_b -> dquot_acquire -> commit_dqblk -> v2_write_dquot:
      qtree_write_dquot
       do_insert_tree
        find_free_dqentry
         get_free_dqblk
          dh = (struct qt_disk_dqdbheader *)buf
          blk = info->dqi_free_blk     // 6
          ret = read_blk(info, blk, buf)  // The content of buf is random
          info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free)  // random blk
    
     Step 5. chown bin f_c -> notify_change -> ext4_setattr -> dquot_transfer:
      dquot = dqget -> acquire_dquot -> ext4_acquire_dquot -> dquot_acquire ->
              commit_dqblk -> v2_write_dquot -> dq_insert_tree:
       do_insert_tree
        find_free_dqentry
         get_free_dqblk
          blk = info->dqi_free_blk    // If blk < 0 and blk is not an error
    				     code, it will be returned as dquot
    
      transfer_to[USRQUOTA] = dquot  // A random negative value
      __dquot_transfer(transfer_to)
       dquot_add_inodes(transfer_to[cnt])
        spin_lock(&dquot->dq_dqb_lock)  // page fault
    
    , which will lead to kernel page fault:
     Quota error (device sda): qtree_write_dquot: Error -8000 occurred
     while creating quota
     BUG: unable to handle page fault for address: ffffffffffffe120
     #PF: supervisor write access in kernel mode
     #PF: error_code(0x0002) - not-present page
     Oops: 0002 [#1] PREEMPT SMP
     CPU: 0 PID: 5974 Comm: chown Not tainted 6.0.0-rc1-00004
     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
     RIP: 0010:_raw_spin_lock+0x3a/0x90
     Call Trace:
      dquot_add_inodes+0x28/0x270
      __dquot_transfer+0x377/0x840
      dquot_transfer+0xde/0x540
      ext4_setattr+0x405/0x14d0
      notify_change+0x68e/0x9f0
      chown_common+0x300/0x430
      __x64_sys_fchownat+0x29/0x40
    
    In order to avoid accessing invalid quota memory address, this patch adds
    block number checking of next/prev free block read from quota file.
    
    Fetch a reproducer in [Link].
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=216372
    
    
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Signed-off-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
    Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
    Reviewed-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
    Reviewed-by: default avatarZhang Yi <yi.zhang@huawei.com>
    Signed-off-by: default avatarYongqiang Liu <liuyongqiang13@huawei.com>
    6c27d754
    History
    Name Last commit Last update