From patchwork Thu Nov 9 21:49:13 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Jerome Glisse X-Patchwork-Id: 10051983 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 2B75C60631 for ; Thu, 9 Nov 2017 21:49:38 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1F0A52AF11 for ; Thu, 9 Nov 2017 21:49:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1243A2AF19; Thu, 9 Nov 2017 21:49:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BC9FB2AF11 for ; Thu, 9 Nov 2017 21:49:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753088AbdKIVtY (ORCPT ); Thu, 9 Nov 2017 16:49:24 -0500 Received: from mx1.redhat.com ([209.132.183.28]:40590 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751017AbdKIVtX (ORCPT ); Thu, 9 Nov 2017 16:49:23 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id EBE2D5F7BC; Thu, 9 Nov 2017 21:49:22 +0000 (UTC) Received: from localhost.localdomain.com (ovpn-122-37.rdu2.redhat.com [10.10.122.37]) by smtp.corp.redhat.com (Postfix) with ESMTP id 334A05D9C8; Thu, 9 Nov 2017 21:49:22 +0000 (UTC) From: jglisse@redhat.com To: linux-kernel@vger.kernel.org Cc: =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?= , Al Viro , linux-fsdevel@vger.kernel.org, stable@vger.kernel.org, Linus Torvalds Subject: [PATCH] fs: avoid NULL pointer dereference for nobh on write error Date: Thu, 9 Nov 2017 16:49:13 -0500 Message-Id: <20171109214913.7814-1-jglisse@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Thu, 09 Nov 2017 21:49:23 +0000 (UTC) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Jérôme Glisse (Result of code inspection only, i do not have a bug, nor know a bug that would be explain by this issue. Is there a kernel trace database one can query for that ?) When fs is mounted with nobh temporary buffer_head are created during write and they are only associated with the page when a filesystem error happen. When this happen nobh_write_begin() or nobh_write_end() call attach_nobh_buffers() which expect that provided buffer_head list is circular (ie tail entry point to head entry). If it is not the case it will dereference the last pointer in the list which is NULL (last item in the list point to NULL see alloc_page_buffers()) and thus SEGFAULT. Hence nobh_write_begin() must make the buffer_head list circular as alloc_page_buffers() is not responsible for doing that. (This might worth including in 4.14 as i don't think it can regress anything but i am not a filesystem expert). Note i did not make the list circular inside attach_nobh_buffers() as some patchset i am working on also expect the list to be circular no matter what. But if people are more confortable with me doing that in my patchset the fix can be move to attach_nobh_buffers(). Signed-off-by: Jérôme Glisse Cc: Al Viro Cc: linux-fsdevel@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Cc: Linus Torvalds --- fs/buffer.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/buffer.c b/fs/buffer.c index 170df856bdb9..6bc47c11d6ac 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2598,7 +2598,7 @@ int nobh_write_begin(struct address_space *mapping, struct inode *inode = mapping->host; const unsigned blkbits = inode->i_blkbits; const unsigned blocksize = 1 << blkbits; - struct buffer_head *head, *bh; + struct buffer_head *head, *bh, *tail; struct page *page; pgoff_t index; unsigned from, to; @@ -2643,6 +2643,13 @@ int nobh_write_begin(struct address_space *mapping, ret = -ENOMEM; goto out_release; } + /* We need to make buffer_head list circular to avoid NULL SEGFAULT */ + bh = head; + do { + tail = bh; + bh = bh->b_this_page; + } while (bh); + tail->b_this_page = head; block_in_file = (sector_t)page->index << (PAGE_SHIFT - blkbits);