linux-kernel - Re: [PATCH] ext4: unregister extents status shrinker if mount failed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5171C4AD.2070905@gmail.com>
Date:	Sat, 20 Apr 2013 06:26:53 +0800
From:	Zheng Liu <gnehzuil.liu@...il.com>
To:	Alexey Khoroshilov <khoroshilov@...ras.ru>
CC:	Theodore Ts'o <tytso@....edu>,
	Andreas Dilger <adilger.kernel@...ger.ca>,
	linux-ext4@...r.kernel.org, linux-kernel@...r.kernel.org,
	spruce-project@...uxtesting.org
Subject: Re: [PATCH] ext4: unregister extents status shrinker if mount failed

On 04/20/2013 06:05 AM, Alexey Khoroshilov wrote:
> If ext4_fill_super() failed after extents status shrinker
> has been registered, the shrinker is left in a global list
> while the memory, it sits in, is already freed.
> Oops is not so bad scenario after that.
> 
> Found by Linux File System Verification project (linuxtesting.org).
> 
> Signed-off-by: Alexey Khoroshilov <khoroshilov@...ras.ru>

Thanks for your patch.  This problem has been fixed in dev branch of
ext4 tree, but has not push into mainline kernel yet.  Here is the
commit id (a75ae78f087f933ab3432e98bb4dbbf2196cf6d5).

Thanks,
						- Zheng

> ---
>  fs/ext4/super.c |    6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/ext4/super.c b/fs/ext4/super.c
> index 5d6d5357..5f9cb30 100644
> --- a/fs/ext4/super.c
> +++ b/fs/ext4/super.c
> @@ -3757,7 +3757,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
>  	if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_MMP) &&
>  	    !(sb->s_flags & MS_RDONLY))
>  		if (ext4_multi_mount_protect(sb, le64_to_cpu(es->s_mmp_block)))
> -			goto failed_mount3;
> +			goto failed_mount_shr;
>  
>  	/*
>  	 * The first inode we look at is the journal inode.  Don't try
> @@ -3766,7 +3766,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
>  	if (!test_opt(sb, NOLOAD) &&
>  	    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_HAS_JOURNAL)) {
>  		if (ext4_load_journal(sb, es, journal_devnum))
> -			goto failed_mount3;
> +			goto failed_mount_shr;
>  	} else if (test_opt(sb, NOLOAD) && !(sb->s_flags & MS_RDONLY) &&
>  	      EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER)) {
>  		ext4_msg(sb, KERN_ERR, "required journal recovery "
> @@ -4009,6 +4009,8 @@ failed_mount_wq:
>  		jbd2_journal_destroy(sbi->s_journal);
>  		sbi->s_journal = NULL;
>  	}
> +failed_mount_shr:
> +	ext4_es_unregister_shrinker(sb);
>  failed_mount3:
>  	del_timer(&sbi->s_err_report);
>  	if (sbi->s_flex_groups)
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/