lkml.org 
[lkml]   [2022]   [Apr]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 05/62] gfs2: assign rgrp glock before compute_bitstructs
    Date
    From: Bob Peterson <rpeterso@redhat.com>

    commit 428f651cb80b227af47fc302e4931791f2fb4741 upstream.

    Before this patch, function read_rindex_entry called compute_bitstructs
    before it allocated a glock for the rgrp. But if compute_bitstructs found
    a problem with the rgrp, it called gfs2_consist_rgrpd, and that called
    gfs2_dump_glock for rgd->rd_gl which had not yet been assigned.

    read_rindex_entry
    compute_bitstructs
    gfs2_consist_rgrpd
    gfs2_dump_glock <---------rgd->rd_gl was not set.

    This patch changes read_rindex_entry so it assigns an rgrp glock before
    calling compute_bitstructs so gfs2_dump_glock does not reference an
    unassigned pointer. If an error is discovered, the glock must also be
    put, so a new goto and label were added.

    Reported-by: syzbot+c6fd14145e2f62ca0784@syzkaller.appspotmail.com
    Signed-off-by: Bob Peterson <rpeterso@redhat.com>
    Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/gfs2/rgrp.c | 9 +++++----
    1 file changed, 5 insertions(+), 4 deletions(-)

    --- a/fs/gfs2/rgrp.c
    +++ b/fs/gfs2/rgrp.c
    @@ -925,15 +925,15 @@ static int read_rindex_entry(struct gfs2
    rgd->rd_bitbytes = be32_to_cpu(buf.ri_bitbytes);
    spin_lock_init(&rgd->rd_rsspin);

    - error = compute_bitstructs(rgd);
    - if (error)
    - goto fail;
    -
    error = gfs2_glock_get(sdp, rgd->rd_addr,
    &gfs2_rgrp_glops, CREATE, &rgd->rd_gl);
    if (error)
    goto fail;

    + error = compute_bitstructs(rgd);
    + if (error)
    + goto fail_glock;
    +
    rgd->rd_rgl = (struct gfs2_rgrp_lvb *)rgd->rd_gl->gl_lksb.sb_lvbptr;
    rgd->rd_flags &= ~(GFS2_RDF_UPTODATE | GFS2_RDF_PREFERRED);
    if (rgd->rd_data > sdp->sd_max_rg_data)
    @@ -950,6 +950,7 @@ static int read_rindex_entry(struct gfs2
    }

    error = 0; /* someone else read in the rgrp; free it and ignore it */
    +fail_glock:
    gfs2_glock_put(rgd->rd_gl);

    fail:

    \
     
     \ /
      Last update: 2022-04-26 10:43    [W:4.118 / U:0.408 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site