linux-ext4 - Re: [PATCH] ext4: set h_journal if there is a failure starting a reserved handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180419093214.ha6mur2tiaqmoe3t@quack2.suse.cz>
Date:   Thu, 19 Apr 2018 11:32:14 +0200
From:   Jan Kara <jack@...e.cz>
To:     Theodore Ts'o <tytso@....edu>
Cc:     Ext4 Developers List <linux-ext4@...r.kernel.org>,
        Jan Kara <jack@...e.cz>, stable@...nel.org
Subject: Re: [PATCH] ext4: set h_journal if there is a failure starting a
 reserved handle

On Wed 18-04-18 11:49:46, Theodore Ts'o wrote:
> If ext4 tries to start a reserved handle via
> jbd2_journal_start_reserved(), and the journal has been aborted, this
> can result in a NULL pointer dereference.  This is because the fields
> h_journal and h_transaction in the handle structure share the same
> meory, via a union, so jbd2_journal_start_reserved() will clear
> h_journal before calling start_this_handle().  If this function fails
> due to an aborted handle, h_journal will still be NULL, and the call
> to jbd2_journal_free_reserved() will pass a NULL journal to
> sub_reserve_credits().
> 
> This can be reproduced by running "kvm-xfstests -c dioread_nolock
> generic/475".
> 
> Fixes: 8f7d89f36829b ("jbd2: transaction reservation support")
> Signed-off-by: Theodore Ts'o <tytso@....edu>
> Cc: Jan Kara <jack@...e.cz>
> Cc: stable@...nel.org # 3.11

Thanks for fixing this! The patch looks good to me. You can add:

Reviewed-by: Jan Kara <jack@...e.cz>

								Honza

> ---
>  fs/jbd2/transaction.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
> index ac311037d7a5..8aa453784402 100644
> --- a/fs/jbd2/transaction.c
> +++ b/fs/jbd2/transaction.c
> @@ -532,6 +532,7 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
>  	 */
>  	ret = start_this_handle(journal, handle, GFP_NOFS);
>  	if (ret < 0) {
> +		handle->h_journal = journal;
>  		jbd2_journal_free_reserved(handle);
>  		return ret;
>  	}
> -- 
> 2.16.1.72.g5be1f00a9a
> 
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR