| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 16 May 2011 12:31:15 +0300 From: Amir Goldstein <amir73il@...il.com> To: Ext4 Developers List <linux-ext4@...r.kernel.org> Cc: Theodore Tso <tytso@....edu>, Jan Kara <jack@...e.cz> Subject: [PATCH] ext4: fix NULL pointer dereference in ext4_quota_off This fixes a bug in commit 21f97697 (ext4: remove unnecessary [cm]time update of quota file) The above commit was merged for 2.6.39-rc3 and introduced a crash in xfstest 232 (Run fsstress with quotas enabled and verify accounted quotas in the end). Signed-off-by: Amir Goldstein <amir73il@...rs.sf.net> --- This fix solves the crash on my system, but the test still fails with the following output: QA output created by 232 Testing fsstress fsstress -n 2000 -d outdir -p 7 seed = S Comparing user usage 3a4,493 > #1 -- 2456 0 0 13 0 0 > #10 -- 0 0 0 1 0 0 > #10098 -- 556 0 0 1 0 0 > #1023 -- 20 0 0 1 0 0 > #10253 -- 0 0 0 1 0 0 > #1026286 -- 4 0 0 1 0 0 > #103086187 -- 4 0 0 1 0 0 > #1036 -- 0 0 0 1 0 0 > #1052282 -- 4 0 0 1 0 0 > #1057 -- 260 0 0 1 0 0 I checked with kernel 2.6.38 and the test passes. I also tried reverting the commit, but the test still fails. In any case, the fix resolved the following crash: [ 1319.112544] EXT4-fs (sda8): mounted filesystem with ordered data mode. Opts: acl,user_xattr,usrquota,grpquota [ 1319.270023] EXT4-fs (sda8): re-mounted. Opts: (null) [ 1319.271464] EXT4-fs (sda8): re-mounted. Opts: (null) [ 1368.214854] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 [ 1368.219348] IP: [<ffffffff8122e152>] ext4_quota_off+0x42/0xd0 [ 1368.221628] PGD 0 [ 1368.222978] Oops: 0000 [#2] SMP [ 1368.222978] last sysfs file: /sys/devices/system/cpu/cpu3/cache/index2/shared_cpu_map [ 1368.222978] CPU 0 [ 1368.222978] Modules linked in: binfmt_misc parport_pc ppdev snd_hda_codec_realtek snd_hda_intel snd_hda_codec i915 snd_hwdep snd_pcm drm_kms_helper drm snd_seq_midi snd_rawmidi e1000e snd_seq_midi_event i2c_algo_bit snd_seq lp firewire_ohci firewire_core snd_timer snd_seq_device snd soundcore snd_page_alloc psmouse parport pata_marvell usbhid hid video intel_agp intel_gtt tpm_tis crc_itu_t serio_raw tpm tpm_bios [ 1368.222978] [ 1368.222978] Pid: 2691, comm: quotaon Tainted: G M D 2.6.39-rc7 #9 /DQ35JO [ 1368.222978] RIP: 0010:[<ffffffff8122e152>] [<ffffffff8122e152>] ext4_quota_off+0x42/0xd0 [ 1368.222978] RSP: 0018:ffff8800c4bb3e28 EFLAGS: 00010292 [ 1368.222978] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000018 [ 1368.222978] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000246 [ 1368.222978] RBP: ffff8800c4bb3e48 R08: 0000000000000001 R09: 0000000000000000 [ 1368.222978] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880114576000 [ 1368.222978] R13: ffff880114576000 R14: 0000000000000001 R15: 0000000000000000 [ 1368.222978] FS: 00007f5c2bf97720(0000) GS:ffff88012bc00000(0000) knlGS:0000000000000000 [ 1368.222978] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 1368.222978] CR2: 0000000000000018 CR3: 00000000c693f000 CR4: 00000000000006f0 [ 1368.222978] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1368.222978] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1368.222978] Process quotaon (pid: 2691, threadinfo ffff8800c4bb2000, task ffff880116bc5ee0) [ 1368.222978] Stack: [ 1368.222978] 0000000000800003 0000000000000001 ffff880114576000 00000000ffffffda [ 1368.222978] ffff8800c4bb3ef8 ffffffff811c9e05 0000000000000000 0000000000000000 [ 1368.222978] ffff8800c4bb3e78 ffff880114576068 ffff880115009800 ffff880114576068 [ 1368.222978] Call Trace: [ 1368.222978] [<ffffffff811c9e05>] do_quotactl+0x4e5/0x560 [ 1368.222978] [<ffffffff815d376c>] ? down_read+0x4c/0x70 [ 1368.222978] [<ffffffff811711cf>] ? get_super+0x9f/0xd0 [ 1368.222978] [<ffffffff81189f78>] ? iput+0x48/0x200 [ 1368.222978] [<ffffffff811c9f4c>] sys_quotactl+0xcc/0x1a0 [ 1368.222978] [<ffffffff8116be26>] ? filp_close+0x66/0x90 [ 1368.222978] [<ffffffff812fd76e>] ? trace_hardirqs_on_thunk+0x3a/0x3f [ 1368.222978] [<ffffffff815dd2c2>] system_call_fastpath+0x16/0x1b [ 1368.222978] Code: 89 74 24 18 0f 1f 44 00 00 48 63 c6 49 89 fc 41 89 f6 48 8b 9c c7 60 03 00 00 48 8b 87 90 04 00 00 f6 40 73 08 0f 85 7e 00 00 00 [ 1368.222978] 8b 7b 18 be 01 00 00 00 e8 c0 fb ff ff 48 3d 00 f0 ff ff 49 [ 1368.222978] RIP [<ffffffff8122e152>] ext4_quota_off+0x42/0xd0 [ 1368.222978] RSP <ffff8800c4bb3e28> [ 1368.222978] CR2: 0000000000000018 [ 1368.310246] ---[ end trace 62a147f050ade229 ]--- fs/ext4/super.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index fc827bb..2689351 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -4681,6 +4681,9 @@ static int ext4_quota_off(struct super_block *sb, int type) if (test_opt(sb, DELALLOC)) sync_filesystem(sb); + if (!inode) + goto out; + /* Update modification times of quota files when userspace can * start looking at them */ handle = ext4_journal_start(inode, 1); -- 1.7.4.1 -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists