mirror of
https://github.com/nxp-imx/linux-imx.git
synced 2025-07-05 17:05:21 +02:00
ext4: avoid use-after-free in ext4_ext_show_leaf()
[ Upstream commit 4e2524ba2c
]
In ext4_find_extent(), path may be freed by error or be reallocated, so
using a previously saved *ppath may have been freed and thus may trigger
use-after-free, as follows:
ext4_split_extent
path = *ppath;
ext4_split_extent_at(ppath)
path = ext4_find_extent(ppath)
ext4_split_extent_at(ppath)
// ext4_find_extent fails to free path
// but zeroout succeeds
ext4_ext_show_leaf(inode, path)
eh = path[depth].p_hdr
// path use-after-free !!!
Similar to ext4_split_extent_at(), we use *ppath directly as an input to
ext4_ext_show_leaf(). Fix a spelling error by the way.
Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only
used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly.
This issue is triggered only when EXT_DEBUG is defined and therefore does
not affect functionality.
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Tested-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Link: https://patch.msgid.link/20240822023545.1994557-5-libaokun@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
1fe2852720
commit
34b2096380
|
@ -3287,7 +3287,7 @@ out:
|
|||
}
|
||||
|
||||
/*
|
||||
* ext4_split_extents() splits an extent and mark extent which is covered
|
||||
* ext4_split_extent() splits an extent and mark extent which is covered
|
||||
* by @map as split_flags indicates
|
||||
*
|
||||
* It may result in splitting the extent into multiple extents (up to three)
|
||||
|
@ -3363,7 +3363,7 @@ static int ext4_split_extent(handle_t *handle,
|
|||
goto out;
|
||||
}
|
||||
|
||||
ext4_ext_show_leaf(inode, path);
|
||||
ext4_ext_show_leaf(inode, *ppath);
|
||||
out:
|
||||
return err ? err : allocated;
|
||||
}
|
||||
|
@ -3828,14 +3828,13 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode,
|
|||
struct ext4_ext_path **ppath, int flags,
|
||||
unsigned int allocated, ext4_fsblk_t newblock)
|
||||
{
|
||||
struct ext4_ext_path __maybe_unused *path = *ppath;
|
||||
int ret = 0;
|
||||
int err = 0;
|
||||
|
||||
ext_debug(inode, "logical block %llu, max_blocks %u, flags 0x%x, allocated %u\n",
|
||||
(unsigned long long)map->m_lblk, map->m_len, flags,
|
||||
allocated);
|
||||
ext4_ext_show_leaf(inode, path);
|
||||
ext4_ext_show_leaf(inode, *ppath);
|
||||
|
||||
/*
|
||||
* When writing into unwritten space, we should not fail to
|
||||
|
@ -3932,7 +3931,7 @@ out1:
|
|||
if (allocated > map->m_len)
|
||||
allocated = map->m_len;
|
||||
map->m_len = allocated;
|
||||
ext4_ext_show_leaf(inode, path);
|
||||
ext4_ext_show_leaf(inode, *ppath);
|
||||
out2:
|
||||
return err ? err : allocated;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue
Block a user