lkml.org 
[lkml]   [2016]   [Apr]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 186/217] ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()
    3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eryu Guan <guaneryu@gmail.com>

    commit 5e1021f2b6dff1a86a468a1424d59faae2bc63c1 upstream.

    ext4_reserve_inode_write() in ext4_mark_inode_dirty() could fail on
    error (e.g. EIO) and iloc.bh can be NULL in this case. But the error is
    ignored in the following "if" condition and ext4_expand_extra_isize()
    might be called with NULL iloc.bh set, which triggers NULL pointer
    dereference.

    This is uncovered by commit 8b4953e13f4c ("ext4: reserve code points for
    the project quota feature"), which enlarges the ext4_inode size, and
    run the following script on new kernel but with old mke2fs:

    #/bin/bash
    mnt=/mnt/ext4
    devname=ext4-error
    dev=/dev/mapper/$devname
    fsimg=/home/fs.img

    trap cleanup 0 1 2 3 9 15

    cleanup()
    {
    umount $mnt >/dev/null 2>&1
    dmsetup remove $devname
    losetup -d $backend_dev
    rm -f $fsimg
    exit 0
    }

    rm -f $fsimg
    fallocate -l 1g $fsimg
    backend_dev=`losetup -f --show $fsimg`
    devsize=`blockdev --getsz $backend_dev`

    good_tab="0 $devsize linear $backend_dev 0"
    error_tab="0 $devsize error $backend_dev 0"

    dmsetup create $devname --table "$good_tab"

    mkfs -t ext4 $dev
    mount -t ext4 -o errors=continue,strictatime $dev $mnt

    dmsetup load $devname --table "$error_tab" && dmsetup resume $devname
    echo 3 > /proc/sys/vm/drop_caches
    ls -l $mnt
    exit 0

    [ Patch changed to simplify the function a tiny bit. -- Ted ]

    Signed-off-by: Eryu Guan <guaneryu@gmail.com>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    fs/ext4/inode.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    --- a/fs/ext4/inode.c
    +++ b/fs/ext4/inode.c
    @@ -5008,6 +5008,8 @@ int ext4_mark_inode_dirty(handle_t *hand
    might_sleep();
    trace_ext4_mark_inode_dirty(inode, _RET_IP_);
    err = ext4_reserve_inode_write(handle, inode, &iloc);
    + if (err)
    + return err;
    if (ext4_handle_valid(handle) &&
    EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize &&
    !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) {
    @@ -5038,9 +5040,7 @@ int ext4_mark_inode_dirty(handle_t *hand
    }
    }
    }
    - if (!err)
    - err = ext4_mark_iloc_dirty(handle, inode, &iloc);
    - return err;
    + return ext4_mark_iloc_dirty(handle, inode, &iloc);
    }

    /*
    \
     
     \ /
      Last update: 2016-04-27 02:41    [W:4.267 / U:0.220 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site