Dan Carpenter 37b0b6b8b9 ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() ... If sbi->s_flex_groups_allocated is zero and the first allocation fails then this code will crash. The problem is that "i--" will set "i" to -1 but when we compare "i >= sbi->s_flex_groups_allocated" then the -1 is type promoted to unsigned and becomes UINT_MAX. Since UINT_MAX is more than zero, the condition is true so we call kvfree(new_groups[-1]). The loop will carry on freeing invalid memory until it crashes. Fixes: 7c990728b9 ("ext4: fix potential race between s_flex_groups online resizing and access") Reviewed-by: Suraj Jitindar Singh <surajjs@amazon.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable@kernel.org Link: https://lore.kernel.org/r/20200228092142.7irbc44yaz3by7nb@kili.mountain Signed-off-by: Theodore Ts'o <tytso@mit.edu>		2020-02-29 17:48:08 -05:00
..
acl.c
acl.h
balloc.c	ext4: fix potential race between online resizing and write operations	2020-02-21 00:37:09 -05:00
bitmap.c
block_validity.c	ext4: add cond_resched() to ext4_protect_reserved_inode	2020-02-13 11:56:26 -05:00
dir.c	ext4: fix checksum errors with indexed dirs	2020-02-13 11:56:19 -05:00
ext4.h	ext4: fix race between writepages and enabling EXT4_EXTENTS_FL	2020-02-21 19:32:07 -05:00
ext4_extents.h
ext4_jbd2.c
ext4_jbd2.h
extents.c
extents_status.c
extents_status.h
file.c
fsmap.c
fsmap.h
fsync.c
hash.c
ialloc.c	ext4: fix potential race between s_flex_groups online resizing and access	2020-02-21 19:31:46 -05:00
indirect.c
inline.c
inode-test.c
inode.c	ext4: rename s_journal_flag_rwsem to s_writepages_rwsem	2020-02-21 19:32:07 -05:00
ioctl.c
Kconfig
Makefile
mballoc.c	ext4: fix potential race between s_flex_groups online resizing and access	2020-02-21 19:31:46 -05:00
mballoc.h
migrate.c	ext4: fix race between writepages and enabling EXT4_EXTENTS_FL	2020-02-21 19:32:07 -05:00
mmp.c	ext4: don't assume that mmp_nodename/bdevname have NUL	2020-02-13 11:53:10 -05:00
move_extent.c
namei.c	ext4: add cond_resched() to __ext4_find_entry()	2020-02-19 23:53:52 -05:00
page-io.c
readpage.c
resize.c	ext4: fix potential race between s_flex_groups online resizing and access	2020-02-21 19:31:46 -05:00
super.c	ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()	2020-02-29 17:48:08 -05:00
symlink.c
sysfs.c
truncate.h
verity.c
xattr.c
xattr.h
xattr_security.c
xattr_trusted.c
xattr_user.c