diff options
| author | Baokun Li <libaokun1@huawei.com> | 2024-04-09 15:18:15 +0800 |
|---|---|---|
| committer | ZhaoLong Wang <wangzhaolong1@huawei.com> | 2024-04-09 15:32:48 +0800 |
| commit | 148c854caa085307184d31755372159168daf13f (patch) | |
| tree | 9b163d6ad2bb21fee8fe7cbab19388afa5cbee55 | |
| parent | fdf52a7d6b5fca5b90338576a43a90ed5978e89d (diff) | |
| download | openEuler-kernel-148c854caa085307184d31755372159168daf13f.tar.gz | |
ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
mainline inclusion
from mainline-v6.8-rc3
commit 832698373a25950942c04a512daa652c18a9b513
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MF
CVE: CVE-2024-26772
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=832698373a25950942c04a512daa652c18a9b513
--------------------------------
Places the logic for checking if the group's block bitmap is corrupt under
the protection of the group lock to avoid allocating blocks from the group
with a corrupted block bitmap.
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20240104142040.2835097-8-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com>
| -rw-r--r-- | fs/ext4/mballoc.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 093f04c0f9cbe4..ecc2be34432b04 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -1911,12 +1911,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, if (err) return err; - if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) { - ext4_mb_unload_buddy(e4b); - return 0; - } - ext4_lock_group(ac->ac_sb, group); + if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) + goto out; + max = mb_find_extent(e4b, ac->ac_g_ex.fe_start, ac->ac_g_ex.fe_len, &ex); ex.fe_logical = 0xDEADFA11; /* debug value */ @@ -1949,6 +1947,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, ac->ac_b_ex = ex; ext4_mb_use_best_found(ac, e4b); } +out: ext4_unlock_group(ac->ac_sb, group); ext4_mb_unload_buddy(e4b); |