Qu Wenruo ab4ba2e133 btrfs: tree-checker: Verify dev item ... [BUG] For fuzzed image whose DEV_ITEM has invalid total_bytes as 0, then kernel will just panic: BUG: unable to handle kernel NULL pointer dereference at 0000000000000098 #PF error: [normal kernel read fault] PGD 800000022b2bd067 P4D 800000022b2bd067 PUD 22b2bc067 PMD 0 Oops: 0000 [#1] SMP PTI CPU: 0 PID: 1106 Comm: mount Not tainted 5.0.0-rc8+ #9 RIP: 0010:btrfs_verify_dev_extents+0x2a5/0x5a0 Call Trace: open_ctree+0x160d/0x2149 btrfs_mount_root+0x5b2/0x680 [CAUSE] If device extent verification finds a deivce with 0 total_bytes, then it assumes it's a seed dummy, then search for seed devices. But in this case, there is no seed device at all, causing NULL pointer. [FIX] Since this is caused by fuzzed image, let's go the tree-check way, just add a new verification for device item. Reported-by: Yoon Jungyeon <jungyeon@gatech.edu> Link: https://bugzilla.kernel.org/show_bug.cgi?id=202691 Reviewed-by: Nikolay Borisov <nborisov@suse.com> Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de> Signed-off-by: David Sterba <dsterba@suse.com>		2019-04-29 19:02:32 +02:00
..
9p	Pull request for inlusion in 5.1	2019-03-17 09:10:56 -07:00
adfs
affs
afs	afs: Fix in-progess ops to ignore server-level callback invalidation	2019-04-13 08:37:37 +01:00
autofs	autofs: clear O_NONBLOCK on the pipe	2019-03-07 18:32:01 -08:00
befs
bfs
btrfs	btrfs: tree-checker: Verify dev item	2019-04-29 19:02:32 +02:00
cachefiles
ceph	ceph: fix ci->i_head_snapc leak	2019-04-23 21:37:54 +02:00
cifs	cifs: fix page reference leak with readv/writev	2019-04-24 12:33:59 -05:00
coda
configfs
cramfs
crypto	fscrypt updates for v5.1	2019-03-09 10:54:24 -08:00
debugfs	debugfs: fix use-after-free on symlink traversal	2019-04-01 00:31:02 -04:00
devpts
dlm
ecryptfs
efivarfs
efs
exportfs
ext2	\n	2019-03-07 09:01:33 -08:00
ext4	Miscellaneous ext4 bug fixes for 5.1.	2019-03-24 13:41:37 -07:00
f2fs	f2fs-for-5.1-rc1	2019-03-15 13:42:53 -07:00
fat	fat: enable .splice_write to support splice on O_DIRECT file	2019-03-07 18:32:01 -08:00
freevxfs
fscache
fuse	Merge branch 'page-refs' (page ref overflow)	2019-04-14 15:09:40 -07:00
gfs2	We've only got three patches ready for this merge window:	2019-03-09 11:52:11 -08:00
hfs
hfsplus
hostfs
hpfs	hpfs: fix spelling mistake "partion" -> "partition"	2019-03-12 09:58:03 -07:00
hugetlbfs	hugetlbfs: fix memory leak for resv_map	2019-04-05 16:02:31 -10:00
isofs
jbd2
jffs2	jffs2: fix use-after-free on symlink traversal	2019-04-01 00:31:02 -04:00
jfs
kernfs	Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 14:08:19 -07:00
lockd	NFS: fix mount/umount race in nlmclnt.	2019-03-18 22:39:34 -04:00
minix
nfs	NFSv4.1 fix incorrect return value in copy_file_range	2019-04-11 15:23:48 -04:00
nfs_common
nfsd	nfsd: wake blocked file lock waiters before sending callback	2019-04-22 15:38:41 -04:00
nilfs2
nls
notify	fanotify: Allow copying of file handle to userspace	2019-03-19 09:29:07 +01:00
ntfs
ocfs2	ocfs2: fix inode bh swapping mixup in ocfs2_reflink_inodes_lock	2019-03-29 10:01:37 -07:00
omfs
openpromfs
orangefs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 13:27:20 -07:00
overlayfs
proc	fs/proc/proc_sysctl.c: Fix a NULL pointer dereference	2019-04-26 09:18:05 -07:00
pstore
qnx4
qnx6
quota
ramfs
reiserfs
romfs
squashfs
sysfs	Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-16 10:31:02 -07:00
sysv
tracefs
ubifs	ubifs: fix use-after-free on symlink traversal	2019-04-01 00:31:02 -04:00
udf	udf: Propagate errors from udf_truncate_extents()	2019-03-18 16:30:02 +01:00
ufs
xfs	xfs: serialize unaligned dio writes against all other dio writes	2019-03-26 08:37:55 -07:00
aio.c	aio: use kmem_cache_free() instead of kfree()	2019-04-04 20:13:59 -04:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c	fs/binfmt_elf.c: spread const a little	2019-03-07 18:32:01 -08:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
block_dev.c	block: fix the return errno for direct IO	2019-04-11 21:22:21 -06:00
buffer.c
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c
compat.c
coredump.c
d_path.c
dax.c	fs/dax: Deposit pagetable even when installing zero page	2019-03-13 13:58:46 -07:00
dcache.c
dcookies.c
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c	epoll: use rwlock in order to reduce ep_poll_callback() contention	2019-03-07 18:32:01 -08:00
exec.c	exec: increase BINPRM_BUF_SIZE to 256	2019-03-07 18:32:01 -08:00
fcntl.c
fhandle.c
file_table.c
file.c	io_uring-2019-03-06	2019-03-08 14:48:40 -08:00
filesystems.c
fs_context.c
fs_parser.c	fs: fs_parser: fix printk format warning	2019-03-29 10:01:38 -07:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c
inode.c	fs/inode.c: inode_set_flags(): replace opencoded set_mask_bits()	2019-03-05 21:07:13 -08:00
internal.h
io_uring.c	io_uring: remove 'state' argument from io_{read,write} path	2019-04-23 08:17:58 -06:00
ioctl.c
iomap.c	block: add BIO_NO_PAGE_REF flag	2019-03-18 10:44:48 -06:00
Kconfig	Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 14:08:19 -07:00
Kconfig.binfmt
libfs.c
locks.c	locks: wake any locks blocked on request before deadlock check	2019-03-25 08:36:24 -04:00
Makefile	Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 14:08:19 -07:00
mbcache.c
mount.h
mpage.c
namei.c	Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 14:08:19 -07:00
namespace.c	Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 14:08:19 -07:00
no-block.c
nsfs.c
open.c	fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock	2019-04-06 07:01:55 -10:00
pipe.c	Merge branch 'page-refs' (page ref overflow)	2019-04-14 15:09:40 -07:00
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c	fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock	2019-04-06 07:01:55 -10:00
readdir.c
select.c
seq_file.c
signalfd.c
splice.c	There tracing fixes:	2019-04-26 11:09:55 -07:00
stack.c
stat.c
statfs.c
super.c
sync.c
timerfd.c
userfaultfd.c	coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping	2019-04-19 09:46:05 -07:00
utimes.c
xattr.c