1 ext4: fix potential use after free during resize
3 From: Dmitry Monakhov <dmonakhov@openvz.org>
5 We need some sort of synchronization while updating ->s_group_desc
6 because there are a lot of users which can access old ->s_group_desc
7 array after it was released.
9 Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
10 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
12 fs/ext4/balloc.c | 12 ++++++++----
13 fs/ext4/resize.c | 6 ++++--
14 2 files changed, 12 insertions(+), 6 deletions(-)
16 diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
17 index 83a6f49..6e2fbbd 100644
18 --- a/fs/ext4/balloc.c
19 +++ b/fs/ext4/balloc.c
20 @@ -282,6 +282,7 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
22 ext4_group_t ngroups = ext4_get_groups_count(sb);
23 struct ext4_group_desc *desc;
24 + struct buffer_head *gd_bh;
25 struct ext4_sb_info *sbi = EXT4_SB(sb);
27 if (block_group >= ngroups) {
28 @@ -293,7 +294,10 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
30 group_desc = block_group >> EXT4_DESC_PER_BLOCK_BITS(sb);
31 offset = block_group & (EXT4_DESC_PER_BLOCK(sb) - 1);
32 - if (!sbi->s_group_desc[group_desc]) {
34 + gd_bh = *(rcu_dereference(sbi->s_group_desc) + group_desc);
37 ext4_error(sb, "Group descriptor not loaded - "
38 "block_group = %u, group_desc = %u, desc = %u",
39 block_group, group_desc, offset);
40 @@ -301,10 +305,10 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,
43 desc = (struct ext4_group_desc *)(
44 - (__u8 *)sbi->s_group_desc[group_desc]->b_data +
45 - offset * EXT4_DESC_SIZE(sb));
46 + (__u8 *)gd_bh->b_data + offset * EXT4_DESC_SIZE(sb));
48 - *bh = sbi->s_group_desc[group_desc];
54 diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
55 index bf76f40..08c2256 100644
56 --- a/fs/ext4/resize.c
57 +++ b/fs/ext4/resize.c
58 @@ -854,8 +854,9 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
59 memcpy(n_group_desc, o_group_desc,
60 EXT4_SB(sb)->s_gdb_count * sizeof(struct buffer_head *));
61 n_group_desc[gdb_num] = gdb_bh;
62 - EXT4_SB(sb)->s_group_desc = n_group_desc;
63 EXT4_SB(sb)->s_gdb_count++;
64 + rcu_assign_pointer(EXT4_SB(sb)->s_group_desc, n_group_desc);
68 le16_add_cpu(&es->s_reserved_gdt_blocks, -1);
69 @@ -907,8 +908,9 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
70 memcpy(n_group_desc, o_group_desc,
71 EXT4_SB(sb)->s_gdb_count * sizeof(struct buffer_head *));
72 n_group_desc[gdb_num] = gdb_bh;
73 - EXT4_SB(sb)->s_group_desc = n_group_desc;
74 EXT4_SB(sb)->s_gdb_count++;
75 + rcu_assign_pointer(EXT4_SB(sb)->s_group_desc, n_group_desc);
78 BUFFER_TRACE(gdb_bh, "get_write_access");
79 err = ext4_journal_get_write_access(handle, gdb_bh);