linux-kernel - Re: [PATCH] ocfs2: fix the oops problem when write cloned file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 Feb 2020 05:32:28 +0000
From:   Gang He <GHe@...e.com>
To:     Joseph Qi <joseph.qi@...ux.alibaba.com>,
        "mark@...heh.com" <mark@...heh.com>,
        "jlbec@...lplan.org" <jlbec@...lplan.org>,
        "gechangwei@...e.cn" <gechangwei@...e.cn>,
        Shuning Zhang <sunny.s.zhang@...cle.com>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "ocfs2-devel@....oracle.com" <ocfs2-devel@....oracle.com>,
        "akpm@...ux-foundation.org" <akpm@...ux-foundation.org>
Subject: Re: [PATCH] ocfs2: fix the oops problem when write cloned file

Hi Joseph,

before calling ocfs2_refcount_cow() in the function ocfs2_prepare_inode_for_write(), we do not use inode buffer_head.
So, we can let buffer_head is NULL.
But, when we invoke ocfs2_refcount_cow() function, we have to pass inode buffer_head without NULL pointer.
That is why writing clone file will cause oops and kill the user-space process.

Thanks
Gang

________________________________________
From: Joseph Qi <joseph.qi@...ux.alibaba.com>
Sent: Monday, February 3, 2020 1:15 PM
To: Gang He; mark@...heh.com; jlbec@...lplan.org; gechangwei@...e.cn; Shuning Zhang
Cc: linux-kernel@...r.kernel.org; ocfs2-devel@....oracle.com; akpm@...ux-foundation.org
Subject: Re: [PATCH] ocfs2: fix the oops problem when write cloned file



On 20/2/3 10:17, Gang He wrote:
> Hello Joseph, Changwei, Sunny and all,
>
> Could you help to review this patch?
> This patch will fix the oops problem caused by write ocfs2 clone files.
> The root cause is inode buffer head is NULL when calling ocfs2_refcount_cow.
> Secondly, we should use EX meta lock when calling ocfs2_refcount_cow.
>
Before commit e74540b28556, we may also use NULL buffer head in case of
overwrite, so why there is no such issue before?

Thanks,
Joseph