system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-20 19:17:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
linux/fs/gfs2
History
Andrew Price 0e539ca1bb gfs2: Fix NULL pointer dereference in gfs2_rgrp_dump 
When an rindex entry is found to be corrupt, compute_bitstructs() calls
gfs2_consist_rgrpd() which calls gfs2_rgrp_dump() like this:

    gfs2_rgrp_dump(NULL, rgd->rd_gl, fs_id_buf);

gfs2_rgrp_dump then dereferences the gl without checking it and we get

    BUG: KASAN: null-ptr-deref in gfs2_rgrp_dump+0x28/0x280

because there's no rgrp glock involved while reading the rindex on mount.

Fix this by changing gfs2_rgrp_dump to take an rgrp argument.

Reported-by: syzbot+43fa87986bdd31df9de6@syzkaller.appspotmail.com
Signed-off-by: Andrew Price <anprice@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2020-10-14 23:54:43 +02:00
..
acl.c gfs2: Change inode qa_data to allow multiple users 2020-03-27 14:08:04 -05:00
acl.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
aops.c gfs2: use iomap for buffered I/O in ordered and writeback mode 2020-10-14 23:54:42 +02:00
aops.h gfs2: mark stuffed_readpage static 2019-07-03 14:45:18 +02:00
bmap.c gfs2: use iomap for buffered I/O in ordered and writeback mode 2020-10-14 23:54:42 +02:00
bmap.h gfs2: use iomap for buffered I/O in ordered and writeback mode 2020-10-14 23:54:42 +02:00
dentry.c gfs2: untangle the logic in gfs2_drevalidate 2019-09-03 09:42:41 +02:00
dir.c mm: remove the pgprot argument to __vmalloc 2020-06-02 10:59:11 -07:00
dir.h gfs2: Delete an unnecessary check before brelse() 2019-09-04 20:22:17 +02:00
export.c gfs2: Minor gfs2_lookup_by_inum cleanup 2020-06-05 20:19:21 +02:00
file.c Changes in gfs2: 2020-08-10 18:22:43 -07:00
gfs2.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
glock.c gfs2: call truncate_inode_pages_final for address space glocks 2020-10-14 23:54:42 +02:00
glock.h Merge branch 'gfs2-iopen' into for-next 2020-06-05 21:25:36 +02:00
glops.c gfs2: Fix NULL pointer dereference in gfs2_rgrp_dump 2020-10-14 23:54:43 +02:00
glops.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
incore.h gfs2: eliminate GIF_ORDERED in favor of list_empty 2020-07-03 12:05:34 +02:00
inode.c gfs2: Don't return NULL from gfs2_inode_lookup 2020-06-30 13:04:45 +02:00
inode.h gfs2: Minor gfs2_lookup_by_inum cleanup 2020-06-05 20:19:21 +02:00
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
lock_dlm.c gfs2: Force withdraw to replay journals and wait for it to finish 2020-02-27 07:53:12 -06:00
log.c gfs2: Fix bad comment for trans_drain 2020-10-14 23:54:41 +02:00
log.h gfs2: eliminate GIF_ORDERED in favor of list_empty 2020-07-03 12:05:34 +02:00
lops.c treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
lops.h gfs2: Remove active journal side effect from gfs2_write_log_header 2019-11-12 15:17:53 +01:00
main.c gfs2: eliminate GIF_ORDERED in favor of list_empty 2020-07-03 12:05:34 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
meta_io.c gfs2: fix withdraw sequence deadlock 2020-05-06 21:25:26 +02:00
meta_io.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
ops_fstype.c gfs2: The freeze glock should never be frozen 2020-07-03 12:05:35 +02:00
quota.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
quota.h gfs2: move privileged user check to gfs2_quota_lock_check 2020-05-08 18:47:58 +02:00
recovery.c gfs2: When freezing gfs2, use GL_EXACT and not GL_NOCACHE 2020-07-03 12:05:35 +02:00
recovery.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
rgrp.c gfs2: Fix NULL pointer dereference in gfs2_rgrp_dump 2020-10-14 23:54:43 +02:00
rgrp.h gfs2: Fix NULL pointer dereference in gfs2_rgrp_dump 2020-10-14 23:54:43 +02:00
super.c gfs2: simplify the logic in gfs2_evict_inode 2020-10-14 23:54:42 +02:00
super.h gfs2: Force withdraw to replay journals and wait for it to finish 2020-02-27 07:53:12 -06:00
sys.c gfs2: Force withdraw to replay journals and wait for it to finish 2020-02-27 07:53:12 -06:00
sys.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00
trace_gfs2.h gfs2: eliminate rs_inum and reduce the size of gfs2 inodes 2018-06-21 07:39:31 -05:00
trans.c gfs2: add some much needed cleanup for log flushes that fail 2020-08-24 13:54:07 +02:00
trans.h gfs2: new slab for transactions 2020-06-05 21:24:25 +02:00
util.c gfs2: Fix NULL pointer dereference in gfs2_rgrp_dump 2020-10-14 23:54:43 +02:00
util.h gfs2: Make sure we don't miss any delayed withdraws 2020-10-14 23:54:41 +02:00
xattr.c gfs2: Change inode qa_data to allow multiple users 2020-03-27 14:08:04 -05:00
xattr.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 398 2019-06-05 17:37:12 +02:00