lkml.org 
[lkml]   [2021]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 315/421] jfs: fix GPF in diFree
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    commit 9d574f985fe33efd6911f4d752de6f485a1ea732 upstream.

    Avoid passing inode with
    JFS_SBI(inode->i_sb)->ipimap == NULL to
    diFree()[1]. GFP will appear:

    struct inode *ipimap = JFS_SBI(ip->i_sb)->ipimap;
    struct inomap *imap = JFS_IP(ipimap)->i_imap;

    JFS_IP() will return invalid pointer when ipimap == NULL

    Call Trace:
    diFree+0x13d/0x2dc0 fs/jfs/jfs_imap.c:853 [1]
    jfs_evict_inode+0x2c9/0x370 fs/jfs/inode.c:154
    evict+0x2ed/0x750 fs/inode.c:578
    iput_final fs/inode.c:1654 [inline]
    iput.part.0+0x3fe/0x820 fs/inode.c:1680
    iput+0x58/0x70 fs/inode.c:1670

    Reported-and-tested-by: syzbot+0a89a7b56db04c21a656@syzkaller.appspotmail.com
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/jfs/inode.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/fs/jfs/inode.c
    +++ b/fs/jfs/inode.c
    @@ -161,7 +161,8 @@ void jfs_evict_inode(struct inode *inode
    if (test_cflag(COMMIT_Freewmap, inode))
    jfs_free_zero_link(inode);

    - diFree(inode);
    + if (JFS_SBI(inode->i_sb)->ipimap)
    + diFree(inode);

    /*
    * Free the inode from the quota allocation.

    \
     
     \ /
      Last update: 2021-07-19 18:40    [W:4.044 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site