linux-ext4 - Re: [PATCH] ext4: fix NULL pointer dereference in ext4_mark_inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160313070744.GH4672@eguan.usersys.redhat.com>
Date:	Sun, 13 Mar 2016 15:07:45 +0800
From:	Eryu Guan <guaneryu@...il.com>
To:	Theodore Ts'o <tytso@....edu>
Cc:	linux-ext4@...r.kernel.org
Subject: Re: [PATCH] ext4: fix NULL pointer dereference in
 ext4_mark_inode_dirty()

On Sat, Mar 12, 2016 at 09:39:22PM -0500, Theodore Ts'o wrote:
> On Fri, Mar 11, 2016 at 11:38:53PM +0800, Eryu Guan wrote:
> > ext4_reserve_inode_write() in ext4_mark_inode_dirty() could fail on
> > error (e.g. EIO) and iloc.bh can be NULL in this case. But the error is
> > ignored in the following "if" condition and ext4_expand_extra_isize()
> > might be called with NULL iloc.bh set, which triggers NULL pointer
> > dereference.
> 
> Nice catch!  I'm going fix this slightly differently (although I'll
> keep your description).  The patch is a wee bit bigger, but the end
> result is simpler to read.

Yes, it's more easier to read. Thanks!

Eryu

> 
> Thanks,
> 
> 						- Ted
> 
> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> index ce2c4c6..b41432e 100644
> --- a/fs/ext4/inode.c
> +++ b/fs/ext4/inode.c
> @@ -5312,6 +5312,8 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
>  	might_sleep();
>  	trace_ext4_mark_inode_dirty(inode, _RET_IP_);
>  	err = ext4_reserve_inode_write(handle, inode, &iloc);
> +	if (err)
> +		return err;
>  	if (ext4_handle_valid(handle) &&
>  	    EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize &&
>  	    !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) {
> @@ -5342,9 +5344,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
>  			}
>  		}
>  	}
> -	if (!err)
> -		err = ext4_mark_iloc_dirty(handle, inode, &iloc);
> -	return err;
> +	return ext4_mark_iloc_dirty(handle, inode, &iloc);
>  }
>  
>  /*
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html