asgardius/android_kernel_motorola_sm6225
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
android_kernel_motorola_sm6225/fs
History
Petr Cvachoucek 191cf58d06 ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers 
commit 3fea4d9d160186617ff40490ae01f4f4f36b28ff upstream.

it seems freeing the write buffers in the error path of the
ubifs_remount_rw() is wrong. It leads later to a kernel oops like this:

[10016.431274] UBIFS (ubi0:0): start fixing up free space
[10090.810042] UBIFS (ubi0:0): free space fixup complete
[10090.814623] UBIFS error (ubi0:0 pid 512): ubifs_remount_fs: cannot
spawn "ubifs_bgt0_0", error -4
[10101.915108] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started,
PID 517
[10105.275498] Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000030
[10105.284352] Mem abort info:
[10105.287160]   ESR = 0x96000006
[10105.290252]   EC = 0x25: DABT (current EL), IL = 32 bits
[10105.295592]   SET = 0, FnV = 0
[10105.298652]   EA = 0, S1PTW = 0
[10105.301848] Data abort info:
[10105.304723]   ISV = 0, ISS = 0x00000006
[10105.308573]   CM = 0, WnR = 0
[10105.311564] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000f03d1000
[10105.318034] [0000000000000030] pgd=00000000f6cee003,
pud=00000000f4884003, pmd=0000000000000000
[10105.326783] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[10105.332355] Modules linked in: ath10k_pci ath10k_core ath mac80211
libarc4 cfg80211 nvme nvme_core cryptodev(O)
[10105.342468] CPU: 3 PID: 518 Comm: touch Tainted: G           O
5.4.3 #1
[10105.349517] Hardware name: HYPEX CPU (DT)
[10105.353525] pstate: 40000005 (nZcv daif -PAN -UAO)
[10105.358324] pc : atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34
[10105.364596] lr : mutex_lock+0x1c/0x34
[10105.368253] sp : ffff000075633aa0
[10105.371563] x29: ffff000075633aa0 x28: 0000000000000001
[10105.376874] x27: ffff000076fa80c8 x26: 0000000000000004
[10105.382185] x25: 0000000000000030 x24: 0000000000000000
[10105.387495] x23: 0000000000000000 x22: 0000000000000038
[10105.392807] x21: 000000000000000c x20: ffff000076fa80c8
[10105.398119] x19: ffff000076fa8000 x18: 0000000000000000
[10105.403429] x17: 0000000000000000 x16: 0000000000000000
[10105.408741] x15: 0000000000000000 x14: fefefefefefefeff
[10105.414052] x13: 0000000000000000 x12: 0000000000000fe0
[10105.419364] x11: 0000000000000fe0 x10: ffff000076709020
[10105.424675] x9 : 0000000000000000 x8 : 00000000000000a0
[10105.429986] x7 : ffff000076fa80f4 x6 : 0000000000000030
[10105.435297] x5 : 0000000000000000 x4 : 0000000000000000
[10105.440609] x3 : 0000000000000000 x2 : ffff00006f276040
[10105.445920] x1 : ffff000075633ab8 x0 : 0000000000000030
[10105.451232] Call trace:
[10105.453676]  atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34
[10105.459600]  ubifs_garbage_collect+0xb4/0x334
[10105.463956]  ubifs_budget_space+0x398/0x458
[10105.468139]  ubifs_create+0x50/0x180
[10105.471712]  path_openat+0x6a0/0x9b0
[10105.475284]  do_filp_open+0x34/0x7c
[10105.478771]  do_sys_open+0x78/0xe4
[10105.482170]  __arm64_sys_openat+0x1c/0x24
[10105.486180]  el0_svc_handler+0x84/0xc8
[10105.489928]  el0_svc+0x8/0xc
[10105.492808] Code: 52800013 17fffffb d2800003 f9800011 (c85ffc05)
[10105.498903] ---[ end trace 46b721d93267a586 ]---

To reproduce the problem:

1. Filesystem initially mounted read-only, free space fixup flag set.

2. mount -o remount,rw <mountpoint>

3. it takes some time (free space fixup running)
    ... try to terminate running mount by CTRL-C
    ... does not respond, only after free space fixup is complete
    ... then "ubifs_remount_fs: cannot spawn "ubifs_bgt0_0", error -4"

4. mount -o remount,rw <mountpoint>
    ... now finished instantly (fixup already done).

5. Create file or just unmount the filesystem and we get the oops.

Cc: <stable@vger.kernel.org>
Fixes: b50b9f4085 ("UBIFS: do not free write-buffers when in R/O mode")
Signed-off-by: Petr Cvachoucek <cvachoucek@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-27 09:04:30 +01:00
..
9p 9P: Cast to loff_t before multiplying 2020-11-05 11:08:53 +01:00
adfs fs/adfs: super: fix use-after-free bug 2019-08-06 19:06:49 +02:00
affs fs/affs: release old buffer head on error path 2021-03-04 09:39:55 +01:00
afs afs: Fix an IS_ERR() vs NULL check 2021-06-30 08:48:14 -04:00
autofs autofs: fix a leak in autofs_expire_indirect() 2019-12-13 08:51:01 +01:00
befs
bfs bfs: add sanity check at bfs_fill_super() 2018-12-01 09:37:27 +01:00
btrfs btrfs: remove BUG_ON(!eie) in find_parent_nodes 2022-01-27 09:04:27 +01:00
cachefiles cachefiles: Handle readpage error correctly 2020-11-05 11:08:54 +01:00
ceph ceph: lockdep annotations for try_nonblocking_invalidate 2021-09-26 13:39:48 +02:00
cifs cifs: fix incorrect check for null pointer in header_assemble 2021-10-06 15:31:10 +02:00
coda coda: add error handling for fget 2019-08-06 19:06:51 +02:00
configfs configfs: fix memleak in configfs_release_bin_file 2021-07-20 16:15:57 +02:00
cramfs
crypto fscrypt: add fscrypt_symlink_getattr() for computing st_size 2021-09-22 11:47:56 +02:00
debugfs debugfs: fix use-after-free on symlink traversal 2019-05-08 07:21:48 +02:00
devpts fs/devpts: always delete dcache dentry-s in dput() 2019-03-23 20:09:59 +01:00
dlm fs: dlm: filter user dlm messages for kernel locks 2022-01-27 09:04:23 +01:00
ecryptfs Revert "ecryptfs: replace BUG_ON with error handling code" 2021-05-26 11:48:34 +02:00
efivarfs efivarfs: revert "fix memory leak in efivarfs_create()" 2020-12-02 08:48:12 +01:00
efs
exofs exofs_mount(): fix leaks on failure exits 2019-12-05 09:20:32 +01:00
exportfs exportfs: fix 'passing zero to ERR_PTR()' warning 2020-01-27 14:50:02 +01:00
ext2 ext2: fix sleeping in atomic bugs on error 2021-10-09 14:11:03 +02:00
ext4 ext4: avoid trim error on fs with small groups 2022-01-27 09:04:21 +01:00
f2fs f2fs: fix to do sanity check in is_alive() 2022-01-27 09:04:15 +01:00
fat fat: don't allow to mount if the FAT length == 0 2020-06-22 09:05:08 +02:00
freevxfs
fscache fscache: Fix cookie key hashing 2021-09-22 11:48:02 +02:00
fuse fuse: annotate lock in fuse_reverse_inval_entry() 2021-12-22 09:19:04 +01:00
gfs2 gfs2: Fix length of holes reported at end-of-file 2021-12-08 08:50:11 +01:00
hfs hfs: add lock nesting notation to hfs_find_init 2021-07-31 08:22:38 +02:00
hfsplus hfsplus: prevent corruption in shrinking truncate 2021-05-22 10:59:45 +02:00
hostfs
hpfs
hugetlbfs hugetlbfs: hugetlb_fault_mutex_hash() cleanup 2021-06-03 08:38:12 +02:00
isofs isofs: Fix out of bound access for corrupted isofs image 2021-11-12 14:40:50 +01:00
jbd2 jbd2: abort journal if free a async write error metadata buffer 2020-09-03 11:24:24 +02:00
jffs2 jffs2: GC deadlock reading a page that is used in jffs2_write_begin() 2022-01-27 09:04:26 +01:00
jfs JFS: fix memleak in jfs_mount 2021-11-26 11:36:12 +01:00
kernfs kernfs: fix ino wrap-around detection 2019-12-13 08:52:43 +01:00
lockd lockd: don't use interval-based rebinding over TCP 2020-12-30 11:25:59 +01:00
minix fs/minix: remove expected error message in block_to_path() 2020-08-21 11:05:38 +02:00
nfs NFSv42: Fix pagecache invalidation after COPY/CLONE 2021-12-08 08:50:11 +01:00
nfs_common nfs_common: need lock during iterate through the list 2020-12-30 11:26:02 +01:00
nfsd nfsd: fix use-after-free due to delegation race 2021-12-22 09:19:01 +01:00
nilfs2 nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group 2021-09-26 13:39:49 +02:00
nls
notify fanotify: fix ignore mask logic for events on child and on dir 2020-06-30 23:17:00 -04:00
ntfs ntfs: fix validity check for file name attribute 2021-07-20 16:15:39 +02:00
ocfs2 ocfs2: fix data corruption on truncate 2021-11-26 11:35:57 +01:00
omfs
openpromfs
orangefs orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc() 2022-01-27 09:04:13 +01:00
overlayfs ovl: fix warning in ovl_create_real() 2021-12-22 09:19:04 +01:00
proc proc/vmcore: fix clearing user buffer by properly using clear_user() 2021-12-01 09:27:39 +01:00
pstore pstore: Fix typo in compression option name 2021-03-04 09:39:54 +01:00
qnx4 qnx4: work around gcc false positive warning bug 2021-10-06 15:31:20 +02:00
qnx6
quota quota: correct error number in free_dqentry() 2021-11-26 11:36:03 +01:00
ramfs ramfs: fix nommu mmap with gaps in the page cache 2020-10-30 10:38:21 +01:00
reiserfs reiserfs: check directory items on read from disk 2021-08-12 13:19:44 +02:00
romfs romfs: fix uninitialized memory leak in romfs_dev_read() 2020-08-26 10:30:59 +02:00
squashfs squashfs: fix divide error in calculate_skip() 2021-05-22 10:59:45 +02:00
sysfs sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output 2021-03-07 12:19:01 +01:00
sysv sysv: return 'err' instead of 0 in __sysv_write_inode 2018-12-17 09:24:30 +01:00
tracefs tracefs: Set all files to the same group ownership as the mount option 2021-12-14 10:18:07 +01:00
ubifs ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers 2022-01-27 09:04:30 +01:00
udf udf: Fix crash after seekdir 2021-11-26 11:36:23 +01:00
ufs fs/ufs: avoid potential u32 multiplication overflow 2020-08-21 11:05:38 +02:00
xfs xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate 2022-01-11 13:58:49 +01:00
aio.c aio: fix use-after-free due to missing POLLFREE handling 2021-12-14 10:18:07 +01:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf.c elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings 2021-10-06 15:31:24 +02:00
binfmt_elf_fdpic.c
binfmt_em86.c
binfmt_flat.c fs/binfmt_flat.c: make load_flat_shared_library() work 2019-07-03 13:14:44 +02:00
binfmt_misc.c binfmt_misc: fix possible deadlock in bm_register_write 2021-03-17 16:43:51 +01:00
binfmt_script.c exec: load_script: Do not exec truncated interpreter path 2019-11-06 13:05:37 +01:00
block_dev.c block: reexpand iov_iter after read/write 2021-05-22 10:59:49 +02:00
buffer.c fs: Don't invalidate page buffers in block_write_full_page() 2020-11-05 11:08:46 +01:00
char_dev.c chardev: Avoid potential use-after-free in 'chrdev_open()' 2020-01-14 20:06:57 +01:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP 2020-01-09 10:19:07 +01:00
coredump.c coredump: fix crash when umh is disabled 2020-05-14 07:57:21 +02:00
d_path.c
dax.c dax: pass NOWAIT flag to iomap_apply 2020-03-05 16:42:12 +01:00
dcache.c fs, fscrypt: clear DCACHE_ENCRYPTED_NAME when unaliasing directory 2020-11-05 11:08:35 +01:00
dcookies.c
direct-io.c fs: direct-io: fix missing sdio->boundary 2021-04-14 08:22:32 +02:00
drop_caches.c fs: avoid softlockups in s_inodes iterators 2020-01-12 12:17:20 +01:00
eventfd.c eventfd: track eventfd_signal() recursion depth 2020-02-11 04:34:08 -08:00
eventpoll.c ep_create_wakeup_source(): dentry name can change under you... 2020-10-07 08:00:09 +02:00
exec.c vfs: check fd has read access in kernel_read_file_from_fd() 2021-10-27 09:53:13 +02:00
fcntl.c fcntl: fix potential deadlock for &fasync_struct.fa_lock 2021-09-22 11:47:50 +02:00
fhandle.c
file.c fget: check that the fd still exists after getting a ref to it 2021-12-08 08:50:13 +01:00
file_table.c fs: add fget_many() and fput_many() 2021-12-08 08:50:13 +01:00
filesystems.c fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once() 2020-04-17 10:48:51 +02:00
fs-writeback.c writeback: fix obtain a reference to a freeing memcg css 2021-07-20 16:15:52 +02:00
fs_pin.c
fs_struct.c
inode.c futex: Fix inode life-time issue 2020-03-25 08:06:14 +01:00
internal.h acct_on(): don't mess with freeze protection 2019-05-31 06:46:05 -07:00
ioctl.c vfs: fix FIGETBSZ ioctl on an overlayfs file 2018-11-21 09:19:14 +01:00
iomap.c iomap: fix sub-page uptodate handling 2021-05-22 10:59:50 +02:00
Kconfig
Kconfig.binfmt
libfs.c libfs: fix error cast of negative value in simple_attr_write() 2020-11-24 13:27:23 +01:00
locks.c locks: print unsigned ino in /proc/locks 2020-01-09 10:19:00 +01:00
Makefile
mbcache.c
mount.h
mpage.c
namei.c namei: only return -ECHILD from follow_dotdot_rcu() 2020-03-05 16:42:20 +01:00
namespace.c fs: warn about impending deprecation of mandatory locks 2021-08-26 08:36:49 -04:00
no-block.c
nsfs.c dcache: sort the freeing-without-RCU-delay mess for good. 2019-05-25 18:23:26 +02:00
open.c cifs_atomic_open(): fix double-put on late allocation failure 2020-03-18 07:14:21 +01:00
pipe.c pipe: increase minimum default pipe size to 2 pages 2021-08-12 13:19:43 +02:00
pnode.c propagate_one(): mnt_set_mountpoint() needs mount_lock 2020-05-02 17:26:01 +02:00
pnode.h
posix_acl.c
proc_namespace.c
read_write.c vfs: avoid problematic remapping requests into partial EOF block 2019-12-01 09:17:04 +01:00
readdir.c readdir: make sure to verify directory entry for legacy interfaces too 2021-04-28 13:16:50 +02:00
select.c kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data() 2021-03-24 11:07:37 +01:00
seq_file.c seq_file: disallow extremely large seq buffer allocations 2021-07-20 16:16:16 +02:00
signalfd.c signalfd: use wake_up_pollfree() 2021-12-14 10:18:07 +01:00
splice.c splice: only read in as much information as there is pipe buffer space 2019-12-17 20:35:43 +01:00
stack.c
stat.c
statfs.c vfs: Fix EOVERFLOW testing in put_compat_statfs64 2019-10-11 18:21:39 +02:00
super.c vfs: remove lockdep bogosity in __sb_start_write 2020-11-24 13:27:20 +01:00
sync.c
timerfd.c
userfaultfd.c userfaultfd: prevent concurrent API initialization 2021-09-22 11:48:02 +02:00
utimes.c
xattr.c xattr: break delegations in {set,remove}xattr 2020-08-11 15:32:34 +02:00