dont-mark-buffer-has-modified-if-the-handle-is-out-of-credits

   1 jbd2: don't mark block as modified if the handle is out of credits
   2
   3 Do not set the b_modified flag in block's journal head should not
   4 until after we're sure that jbd2_journal_dirty_metadat() will not
   5 abort with an error due to there not being enough space reserved in
   6 the jbd2 handle.
   7
   8 Otherwise, future attempts to modify the buffer may lead a large
   9 number of spurious errors and warnings.
  10
  11 This addresses CVE-2018-10883.
  12
  13 https://bugzilla.kernel.org/show_bug.cgi?id=200071
  14
  15 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  16
  17
  18 ---
  19  fs/jbd2/transaction.c | 9 ++++++++-
  20  1 file changed, 8 insertions(+), 1 deletion(-)
  21
  22 diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
  23 index 51dd68e67b0f..c0b66a7a795b 100644
  24 --- a/fs/jbd2/transaction.c
  25 +++ b/fs/jbd2/transaction.c
  26 @@ -1361,6 +1361,13 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
  27                 if (jh->b_transaction == transaction &&
  28                     jh->b_jlist != BJ_Metadata) {
  29                         jbd_lock_bh_state(bh);
  30 +                       if (jh->b_transaction == transaction &&
  31 +                           jh->b_jlist != BJ_Metadata)
  32 +                               pr_err("JBD2: assertion failure: h_type=%u "
  33 +                                      "h_line_no=%u block_no=%llu jlist=%u\n",
  34 +                                      handle->h_type, handle->h_line_no,
  35 +                                      (unsigned long long) bh->b_blocknr,
  36 +                                      jh->b_jlist);
  37                         J_ASSERT_JH(jh, jh->b_transaction != transaction ||
  38                                         jh->b_jlist == BJ_Metadata);
  39                         jbd_unlock_bh_state(bh);
  40 @@ -1380,11 +1387,11 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
  41                  * of the transaction. This needs to be done
  42                  * once a transaction -bzzz
  43                  */
  44 -               jh->b_modified = 1;
  45                 if (handle->h_buffer_credits <= 0) {
  46                         ret = -ENOSPC;
  47                         goto out_unlock_bh;
  48                 }
  49 +               jh->b_modified = 1;
  50                 handle->h_buffer_credits--;
  51         }
  52