linux-kernel - [PATCH 1/3] ext4: Fix an error handling path in ext4_mb_init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <3921e725586edaca611fd3de388f917e959dc85d.1735912719.git.christophe.jaillet@wanadoo.fr>
Date: Fri,  3 Jan 2025 14:59:16 +0100
From: Christophe JAILLET <christophe.jaillet@...adoo.fr>
To: "Theodore Ts'o" <tytso@....edu>,
	Andreas Dilger <adilger.kernel@...ger.ca>,
	Alex Tomas <alex@...sterfs.com>,
	Eric Sandeen <sandeen@...hat.com>,
	"Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>
Cc: linux-kernel@...r.kernel.org,
	kernel-janitors@...r.kernel.org,
	Christophe JAILLET <christophe.jaillet@...adoo.fr>,
	Andreas Dilger <adilger@...sterfs.com>,
	linux-ext4@...r.kernel.org
Subject: [PATCH 1/3] ext4: Fix an error handling path in ext4_mb_init_cache()

'bhs' is an un-initialized pointer.
If 'groups_per_page' == 1, 'bh' is assigned its address.

Then, in the for loop below, if we early exit, either because
"group >= ngroups" or if ext4_get_group_info() fails, then it is still left
un-initialized.

It can then be used.
NULL tests could fail and lead to unexpected behavior. Also, should the
error handling path be called, brelse() would be passed a potentially
invalid value.

Better safe than sorry, just make sure it is correctly initialized to NULL.

Fixes: c9de560ded61 ("ext4: Add multi block allocator for ext4")
Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
---
Compile tested only.

The scenario looks possible, but I don't know if it can really happen...
---
 fs/ext4/mballoc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index b25a27c86696..ff9a124f439b 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -1285,7 +1285,7 @@ static int ext4_mb_init_cache(struct folio *folio, char *incore, gfp_t gfp)
 	ext4_group_t first_group, group;
 	int first_block;
 	struct super_block *sb;
-	struct buffer_head *bhs;
+	struct buffer_head *bhs = NULL;
 	struct buffer_head **bh = NULL;
 	struct inode *inode;
 	char *data;
-- 
2.47.1