linux-ext4 - [PATCH] ext4: release ->i_mutex and resume unlocked dio in swap_inode_boot_loader() (Re: mutex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140209122745.GA12554@gmail.com>
Date:	Sun, 9 Feb 2014 20:27:45 +0800
From:	Zheng Liu <gnehzuil.liu@...il.com>
To:	Ahmed Tamrawi <ahmedtamrawi@...il.com>
Cc:	linux-ext4@...r.kernel.org
Subject: [PATCH] ext4: release ->i_mutex and resume unlocked dio in
 swap_inode_boot_loader() (Re: mutex_unlock is missed ...)

Hi Ahmed,

On Wed, Feb 05, 2014 at 01:39:06PM -0600, Ahmed Tamrawi wrote:
> Hi there!
> 
> Bug Report Filed: https://bugzilla.kernel.org/show_bug.cgi?id=70091
> Linux Version [3.13]
> Configuration: Default configuration for x86
> 
> 
> In function (swap_inode_boot_loader) in file (linux-3.13/fs/ext4/ioctl.c):
> 
> The structures: (inode->i_mutex) and (inode_bl->i_mutex) gets
> successfully locked at line (133) by (lock_two_nondirectories(inode,
> inode_bl), but both are not unlocked when the function returns after
> line (147), however they got unlocked only at line (208) by
> (unlock_two_nondirectories(inode, inode_bl)).
> 
> A possible solution is to call (unlock_two_nondirectories(inode,
> inode_bl)) before line (147).

Thanks for reporting this issue.  I believe the following patch that can
fix the issue.

Regards,
                                                - Zheng

Subject: [PATCH] ext4: release ->i_mutex and resume unlocked dio in swap_inode_boot_loader()

From: Zheng Liu <wenqing.lz@...bao.com>

In swap_inode_boot_loader() we forgot to release ->i_mutex and resume
unlocked dio for inode and inode_bl.  This commit fixes this issue.

Reported-by: Ahmed Tamrawi <ahmedtamrawi@...il.com>
Cc: Andreas Dilger <adilger.kernel@...ger.ca>
Cc: "Theodore Ts'o" <tytso@....edu>
Cc: Dr. Tilmann Bubeck <t.bubeck@...nform.de>
Signed-off-by: Zheng Liu <wenqing.lz@...bao.com>
---
 fs/ext4/ioctl.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 6bea806..a2a837f 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -140,7 +140,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
 	handle = ext4_journal_start(inode_bl, EXT4_HT_MOVE_EXTENTS, 2);
 	if (IS_ERR(handle)) {
 		err = -EINVAL;
-		goto swap_boot_out;
+		goto journal_err_out;
 	}
 
 	/* Protect extent tree against block allocations via delalloc */
@@ -198,6 +198,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
 
 	ext4_double_up_write_data_sem(inode, inode_bl);
 
+journal_err_out:
 	ext4_inode_resume_unlocked_dio(inode);
 	ext4_inode_resume_unlocked_dio(inode_bl);
 
-- 
1.7.9.7

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html