From cec4ee812b7c642c552c64c488a299323d622638 Mon Sep 17 00:00:00 2001 From: Joe Lawrence Date: Fri, 7 Jan 2022 14:11:20 -0500 Subject: [KPATCH CVE-2021-4155] xfs: kpatch fixes for CVE-2021-4155 Kernels: 4.18.0-348.el8 4.18.0-348.2.1.el8_5 4.18.0-348.7.1.el8_5 Changes since last build: arches: x86_64 ppc64le xfs_ioctl.o: changed function: xfs_ioc_space --------------------------- Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-8/-/merge_requests/12 Approved-by: Artem Savkov (@artem.savkov) Kernels: 4.18.0-348.el8 4.18.0-348.2.1.el8_5 4.18.0-348.7.1.el8_5 Modifications: none Z-MR: https://gitlab.com/redhat/prdsc/rhel/src/kernel-private/rhel-8/-/merge_requests/28 KT0 test PASS: https://beaker.engineering.redhat.com/jobs/6173055 for kpatch-patch-4_18_0-348-1-2.el8 scratch build: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=42267085 commit 374251004418783ae2e1e191b957cf63e3796d5e Author: Bruno Meneguele Date: Thu Jan 6 17:19:24 2022 -0300 xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate Bugzilla: https://bugzilla.redhat.com/2034864 CVE: CVE-2021-4155 O-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2034865 O-CVE: CVE-2021-4155 Tested: xfstests and specific reproducer Upstream status: Posted privately due to embargo The old ALLOCSP/FREESP ioctls in XFS can be used to preallocate space at the end of files, just like fallocate and RESVSP. Make the behavior consistent with the other ioctls. Reported-by: Kirill Tkhai Signed-off-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Eric Sandeen (cherry picked from commit 983d8e60f50806f90534cc5373d0ce867e5aaf79) Signed-off-by: Carlos Maiolino Signed-off-by: Bruno Meneguele Signed-off-by: Joe Lawrence --- fs/xfs/xfs_ioctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c index 2a68819e4fe5..7d9c76c5cfb0 100644 --- a/fs/xfs/xfs_ioctl.c +++ b/fs/xfs/xfs_ioctl.c @@ -686,7 +686,8 @@ xfs_ioc_space( if (bf->l_start > XFS_ISIZE(ip)) { error = xfs_alloc_file_space(ip, XFS_ISIZE(ip), - bf->l_start - XFS_ISIZE(ip), 0); + bf->l_start - XFS_ISIZE(ip), + XFS_BMAPI_PREALLOC); if (error) goto out_unlock; } -- 2.26.3