• Eryu Guan's avatar
    ext4: fix NULL pointer dereference in ext4_mark_inode_dirty() · 5e1021f2
    Eryu Guan authored
    ext4_reserve_inode_write() in ext4_mark_inode_dirty() could fail on
    error (e.g. EIO) and iloc.bh can be NULL in this case. But the error is
    ignored in the following "if" condition and ext4_expand_extra_isize()
    might be called with NULL iloc.bh set, which triggers NULL pointer
    dereference.
    
    This is uncovered by commit 8b4953e1 ("ext4: reserve code points for
    the project quota feature"), which enlarges the ext4_inode size, and
    run the following script on new kernel but with old mke2fs:
    
      #/bin/bash
      mnt=/mnt/ext4
      devname=ext4-error
      dev=/dev/mapper/$devname
      fsimg=/home/fs.img
    
      trap cleanup 0 1 2 3 9 15
    
      cleanup()
      {
              umount $mnt >/dev/null 2>&1
              dmsetup remove $devname
              losetup -d $backend_dev
              rm -f $fsimg
              exit 0
      }
    
      rm -f $fsimg
      fallocate -l 1g $fsimg
      backend_dev=`losetup -f --show $fsimg`
      devsize=`blockdev --getsz $backend_dev`
    
      good_tab="0 $devsize linear $backend_dev 0"
      error_tab="0 $devsize error $backend_dev 0"
    
      dmsetup create $devname --table "$good_tab"
    
      mkfs -t ext4 $dev
      mount -t ext4 -o errors=continue,strictatime $dev $mnt
    
      dmsetup load $devname --table "$error_tab" && dmsetup resume $devname
      echo 3 > /proc/sys/vm/drop_caches
      ls -l $mnt
      exit 0
    
    [ Patch changed to simplify the function a tiny bit. -- Ted ]
    Signed-off-by: default avatarEryu Guan <guaneryu@gmail.com>
    Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
    5e1021f2
inode.c 163 KB