diff options
| author | Eryu Guan <guaneryu@gmail.com> | 2016-03-12 21:40:32 -0500 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2016-04-20 08:51:08 +0200 |
| commit | d201f38e6a5823e7881310b7df6ace9e5d0319fe (patch) | |
| tree | 37f8f1211d9b41a249aab58e0d7eb32d84e173ce /fs/ext4 | |
| parent | 7cad2f73e038502abd444bfe22f3c03dbb6da610 (diff) | |
| download | lwn-d201f38e6a5823e7881310b7df6ace9e5d0319fe.tar.gz lwn-d201f38e6a5823e7881310b7df6ace9e5d0319fe.zip | |
ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()
commit 5e1021f2b6dff1a86a468a1424d59faae2bc63c1 upstream.
ext4_reserve_inode_write() in ext4_mark_inode_dirty() could fail on
error (e.g. EIO) and iloc.bh can be NULL in this case. But the error is
ignored in the following "if" condition and ext4_expand_extra_isize()
might be called with NULL iloc.bh set, which triggers NULL pointer
dereference.
This is uncovered by commit 8b4953e13f4c ("ext4: reserve code points for
the project quota feature"), which enlarges the ext4_inode size, and
run the following script on new kernel but with old mke2fs:
#/bin/bash
mnt=/mnt/ext4
devname=ext4-error
dev=/dev/mapper/$devname
fsimg=/home/fs.img
trap cleanup 0 1 2 3 9 15
cleanup()
{
umount $mnt >/dev/null 2>&1
dmsetup remove $devname
losetup -d $backend_dev
rm -f $fsimg
exit 0
}
rm -f $fsimg
fallocate -l 1g $fsimg
backend_dev=`losetup -f --show $fsimg`
devsize=`blockdev --getsz $backend_dev`
good_tab="0 $devsize linear $backend_dev 0"
error_tab="0 $devsize error $backend_dev 0"
dmsetup create $devname --table "$good_tab"
mkfs -t ext4 $dev
mount -t ext4 -o errors=continue,strictatime $dev $mnt
dmsetup load $devname --table "$error_tab" && dmsetup resume $devname
echo 3 > /proc/sys/vm/drop_caches
ls -l $mnt
exit 0
[ Patch changed to simplify the function a tiny bit. -- Ted ]
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'fs/ext4')
| -rw-r--r-- | fs/ext4/inode.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 1ee06f9cdde1..cf5070bb8695 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -4974,6 +4974,8 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) might_sleep(); trace_ext4_mark_inode_dirty(inode, _RET_IP_); err = ext4_reserve_inode_write(handle, inode, &iloc); + if (err) + return err; if (ext4_handle_valid(handle) && EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize && !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) { @@ -5004,9 +5006,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) } } } - if (!err) - err = ext4_mark_iloc_dirty(handle, inode, &iloc); - return err; + return ext4_mark_iloc_dirty(handle, inode, &iloc); } /* |