Ryusuke Konishi cbfee3d9d5 nilfs2: prevent general protection fault in nilfs_clear_dirty_page() ... commit 782e53d0c1 upstream. In a syzbot stress test that deliberately causes file system errors on nilfs2 with a corrupted disk image, it has been reported that nilfs_clear_dirty_page() called from nilfs_clear_dirty_pages() can cause a general protection fault. In nilfs_clear_dirty_pages(), when looking up dirty pages from the page cache and calling nilfs_clear_dirty_page() for each dirty page/folio retrieved, the back reference from the argument page to "mapping" may have been changed to NULL (and possibly others). It is necessary to check this after locking the page/folio. So, fix this issue by not calling nilfs_clear_dirty_page() on a page/folio after locking it in nilfs_clear_dirty_pages() if the back reference "mapping" from the page/folio is different from the "mapping" that held the page/folio just before. Link: https://lkml.kernel.org/r/20230612021456.3682-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Reported-by: syzbot+53369d11851d8f26735c@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/000000000000da4f6b05eb9bf593@google.com Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-06-28 11:12:27 +02:00
..
Kconfig	…
Makefile	…
alloc.c	…
alloc.h	…
bmap.c	…
bmap.h	…
btnode.c	…
btnode.h	…
btree.c	…
btree.h	…
cpfile.c	…
cpfile.h	…
dat.c	…
dat.h	…
dir.c	…
direct.c	…
direct.h	…
export.h	…
file.c	…
gcinode.c	…
ifile.c	…
ifile.h	…
inode.c	…
ioctl.c	…
mdt.c	…
mdt.h	…
namei.c	…
nilfs.h	…
page.c	nilfs2: prevent general protection fault in nilfs_clear_dirty_page()	2023-06-28 11:12:27 +02:00
page.h	…
recovery.c	…
segbuf.c	nilfs2: fix buffer corruption due to concurrent device reads	2023-06-28 11:12:22 +02:00
segbuf.h	…
segment.c	nilfs2: fix buffer corruption due to concurrent device reads	2023-06-28 11:12:22 +02:00
segment.h	…
sufile.c	nilfs2: fix possible out-of-bounds segment allocation in resize ioctl	2023-06-21 16:00:54 +02:00
sufile.h	…
super.c	nilfs2: fix buffer corruption due to concurrent device reads	2023-06-28 11:12:22 +02:00
sysfs.c	…
sysfs.h	…
the_nilfs.c	nilfs2: reject devices with insufficient block count	2023-06-21 16:00:54 +02:00
the_nilfs.h	…