linux-ext4 - Re: [PATCH] ext4: set h_journal if there is a failure starting a reserved handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <5D17CE30-2666-4536-84CA-787C4C2C2278@dilger.ca>
Date:   Wed, 18 Apr 2018 10:07:43 -0600
From:   Andreas Dilger <adilger@...ger.ca>
To:     Theodore Ts'o <tytso@....edu>
Cc:     Ext4 Developers List <linux-ext4@...r.kernel.org>,
        Jan Kara <jack@...e.cz>, stable@...nel.org
Subject: Re: [PATCH] ext4: set h_journal if there is a failure starting a
 reserved handle


> On Apr 18, 2018, at 9:49 AM, Theodore Ts'o <tytso@....edu> wrote:
> 
> If ext4 tries to start a reserved handle via
> jbd2_journal_start_reserved(), and the journal has been aborted, this
> can result in a NULL pointer dereference.  This is because the fields
> h_journal and h_transaction in the handle structure share the same
> meory, via a union, so jbd2_journal_start_reserved() will clear

(typo) s/meory/memory/

Otherwise it looks fine.  I was wondering if it would be safer to
check if (journal == NULL) in jbd2_journal_free_reserved(), but that
adds overhead for each caller, while your patch only adds the extra
code in the error case.

Reviewed-by: Andreas Dilger <adilger@...ger.ca>

> h_journal before calling start_this_handle().  If this function fails
> due to an aborted handle, h_journal will still be NULL, and the call
> to jbd2_journal_free_reserved() will pass a NULL journal to
> sub_reserve_credits().
> 
> This can be reproduced by running "kvm-xfstests -c dioread_nolock
> generic/475".
> 
> Fixes: 8f7d89f36829b ("jbd2: transaction reservation support")
> Signed-off-by: Theodore Ts'o <tytso@....edu>
> Cc: Jan Kara <jack@...e.cz>
> Cc: stable@...nel.org # 3.11
> ---
> fs/jbd2/transaction.c | 1 +
> 1 file changed, 1 insertion(+)
> 
> diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
> index ac311037d7a5..8aa453784402 100644
> --- a/fs/jbd2/transaction.c
> +++ b/fs/jbd2/transaction.c
> @@ -532,6 +532,7 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
> 	 */
> 	ret = start_this_handle(journal, handle, GFP_NOFS);
> 	if (ret < 0) {
> +		handle->h_journal = journal;
> 		jbd2_journal_free_reserved(handle);
> 		return ret;
> 	}
> --
> 2.16.1.72.g5be1f00a9a
> 


Cheers, Andreas






Download attachment "signature.asc" of type "application/pgp-signature" (874 bytes)