lkml.org 
[lkml]   [2022]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 504/530] ext2: Use kvmalloc() for group descriptor array
    Date
    From: Jan Kara <jack@suse.cz>

    [ Upstream commit e7c7fbb9a8574ebd89cc05db49d806c7476863ad ]

    Array of group descriptor block buffers can get rather large. In theory
    in can reach 1MB for perfectly valid filesystem and even more for
    maliciously crafted ones. Use kvmalloc() to allocate the array to avoid
    straining memory allocator with large order allocations unnecessarily.

    Reported-by: syzbot+0f2f7e65a3007d39539f@syzkaller.appspotmail.com
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/ext2/super.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    diff --git a/fs/ext2/super.c b/fs/ext2/super.c
    index fd855574ef09..02d82f8fe85d 100644
    --- a/fs/ext2/super.c
    +++ b/fs/ext2/super.c
    @@ -163,7 +163,7 @@ static void ext2_put_super (struct super_block * sb)
    db_count = sbi->s_gdb_count;
    for (i = 0; i < db_count; i++)
    brelse(sbi->s_group_desc[i]);
    - kfree(sbi->s_group_desc);
    + kvfree(sbi->s_group_desc);
    kfree(sbi->s_debts);
    percpu_counter_destroy(&sbi->s_freeblocks_counter);
    percpu_counter_destroy(&sbi->s_freeinodes_counter);
    @@ -1080,7 +1080,7 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
    }
    db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) /
    EXT2_DESC_PER_BLOCK(sb);
    - sbi->s_group_desc = kmalloc_array(db_count,
    + sbi->s_group_desc = kvmalloc_array(db_count,
    sizeof(struct buffer_head *),
    GFP_KERNEL);
    if (sbi->s_group_desc == NULL) {
    @@ -1206,7 +1206,7 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
    for (i = 0; i < db_count; i++)
    brelse(sbi->s_group_desc[i]);
    failed_mount_group_desc:
    - kfree(sbi->s_group_desc);
    + kvfree(sbi->s_group_desc);
    kfree(sbi->s_debts);
    failed_mount:
    brelse(bh);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-24 16:22    [W:2.324 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site