linux-kernel - Re: [PATCH] direct-io: Prevent NULL pointer access in submit_page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHc6FU4wE2KT5iu-XMvo=XANRtGQfyaRgRpNEppvafsG=yOk7w@mail.gmail.com>
Date:   Mon, 9 Oct 2017 20:24:06 +0200
From:   Andreas Gruenbacher <agruenba@...hat.com>
To:     Al Viro <viro@...iv.linux.org.uk>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Jan Kara <jack@...e.cz>,
        linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        cluster-devel <cluster-devel@...hat.com>
Subject: Re: [PATCH] direct-io: Prevent NULL pointer access in submit_page_section

On 9 October 2017 at 18:22, Al Viro <viro@...iv.linux.org.uk> wrote:
> On Mon, Oct 09, 2017 at 11:13:18AM +0200, Andreas Gruenbacher wrote:
>> In the code added to function submit_page_section by commit b1058b981,
>> sdio->bio can currently be NULL when calling dio_bio_submit.  This then
>> leads to a NULL pointer access in dio_bio_submit, so check for a NULL
>> bio in submit_page_section before trying to submit it instead.
>>
>> Fixes xfstest generic/250 on gfs2.
>>
>> Signed-off-by: Andreas Gruenbacher <agruenba@...hat.com>
>> Reviewed-by: Jan Kara <jack@...e.cz>
>
> How far back in -stable should it go?  I'm fine with the patch, but I'd
> rather have accurate Cc: stable in commit message...

The bug was introduced in 3.10, and apart from a trivial conflict with:

  09cbfeaf1a5a  mm, fs: get rid of PAGE_CACHE_* and
page_cache_{get,release} macros

from v4.6, it applies up to v3.10.

The conflict is in the diff context: page_cache_release has been
replaced by put_page.

Thanks,
Andreas