Unverified Commit 0d426553 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12891 ext4: avoid use-after-free in ext4_ext_show_leaf() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Baokun Li <libaokun1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/KSYNRWZE4LA6KNKVLJ4N5FSAQHRZQD7X/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYR98 
 
Link:https://gitee.com/openeuler/kernel/pulls/12891

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 22dcf78e 867a73e6

fs/ext4/extents.c

+6 −7
Original line number Diff line number Diff line
@@ -3437,7 +3437,7 @@ static int ext4_split_extent_at(handle_t *handle, 
}



/*

 * ext4_split_extents() splits an extent and mark extent which is covered

 * ext4_split_extent() splits an extent and mark extent which is covered

 * by @map as split_flags indicates

 *

 * It may result in splitting the extent into multiple extents (up to three)
@@ -3514,7 +3514,7 @@ static int ext4_split_extent(handle_t *handle, 
			goto out;

	}



	ext4_ext_show_leaf(inode, path);

	ext4_ext_show_leaf(inode, *ppath);

out:

	return err ? err : allocated;

}
@@ -4149,7 +4149,6 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, 
			struct ext4_ext_path **ppath, int flags,

			unsigned int allocated, ext4_fsblk_t newblock)

{

	struct ext4_ext_path *path = *ppath;

	int ret = 0;

	int err = 0;
@@ -4157,7 +4156,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, 
		  "block %llu, max_blocks %u, flags %x, allocated %u\n",

		  inode->i_ino, (unsigned long long)map->m_lblk, map->m_len,

		  flags, allocated);

	ext4_ext_show_leaf(inode, path);

	ext4_ext_show_leaf(inode, *ppath);



	/*

	 * When writing into unwritten space, we should not fail to
@@ -4192,7 +4191,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, 
		if (ret >= 0) {

			ext4_update_inode_fsync_trans(handle, inode, 1);

			err = check_eofblocks_fl(handle, inode, map->m_lblk,

						 path, map->m_len);

						 *ppath, map->m_len);

		} else

			err = ret;

		map->m_flags |= EXT4_MAP_MAPPED;
@@ -4270,7 +4269,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, 
map_out:

	map->m_flags |= EXT4_MAP_MAPPED;

	if ((flags & EXT4_GET_BLOCKS_KEEP_SIZE) == 0) {

		err = check_eofblocks_fl(handle, inode, map->m_lblk, path,

		err = check_eofblocks_fl(handle, inode, map->m_lblk, *ppath,

					 map->m_len);

		if (err < 0)

			goto out2;
@@ -4278,7 +4277,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, 
out1:

	if (allocated > map->m_len)

		allocated = map->m_len;

	ext4_ext_show_leaf(inode, path);

	ext4_ext_show_leaf(inode, *ppath);

	map->m_pblk = newblock;

	map->m_len = allocated;

out2: