dont-mark-buffer-has-modified-if-the-handle-is-out-of-credits

   1 jbd2: don't mark block as modified if the handle is out of credits
   2
   3 Do not set the b_modified flag in block's journal head should not
   4 until after we're sure that jbd2_journal_dirty_metadat() will not
   5 abort with an error due to there not being enough space reserved in
   6 the jbd2 handle.
   7
   8 Otherwise, future attempts to modify the buffer may lead a large
   9 number of spurious errors and warnings.
  10
  11 This addresses CVE-2018-10883.
  12
  13 https://bugzilla.kernel.org/show_bug.cgi?id=200071
  14
  15 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  16 Cc: stable@kernel.org
  17 ---
  18  fs/jbd2/transaction.c | 9 ++++++++-
  19  1 file changed, 8 insertions(+), 1 deletion(-)
  20
  21 diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
  22 index 51dd68e67b0f..c0b66a7a795b 100644
  23 --- a/fs/jbd2/transaction.c
  24 +++ b/fs/jbd2/transaction.c
  25 @@ -1361,6 +1361,13 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
  26                 if (jh->b_transaction == transaction &&
  27                     jh->b_jlist != BJ_Metadata) {
  28                         jbd_lock_bh_state(bh);
  29 +                       if (jh->b_transaction == transaction &&
  30 +                           jh->b_jlist != BJ_Metadata)
  31 +                               pr_err("JBD2: assertion failure: h_type=%u "
  32 +                                      "h_line_no=%u block_no=%llu jlist=%u\n",
  33 +                                      handle->h_type, handle->h_line_no,
  34 +                                      (unsigned long long) bh->b_blocknr,
  35 +                                      jh->b_jlist);
  36                         J_ASSERT_JH(jh, jh->b_transaction != transaction ||
  37                                         jh->b_jlist == BJ_Metadata);
  38                         jbd_unlock_bh_state(bh);
  39 @@ -1380,11 +1387,11 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
  40                  * of the transaction. This needs to be done
  41                  * once a transaction -bzzz
  42                  */
  43 -               jh->b_modified = 1;
  44                 if (handle->h_buffer_credits <= 0) {
  45                         ret = -ENOSPC;
  46                         goto out_unlock_bh;
  47                 }
  48 +               jh->b_modified = 1;
  49                 handle->h_buffer_credits--;
  50         }
  51