Unverified Commit 5cdfb117 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12971 ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yongjian Sun <sunyongjian1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/TVAC76QMMFNC2JZ7WQ7YEG4OBNO4HNPH/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYR8P 
 
Link:https://gitee.com/openeuler/kernel/pulls/12971

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 17249aeb ae3e54b7

fs/ext4/extents.c

+10 −11
Original line number Diff line number Diff line
@@ -5952,7 +5952,7 @@ int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu) 
int ext4_ext_replay_update_ex(struct inode *inode, ext4_lblk_t start,

			      int len, int unwritten, ext4_fsblk_t pblk)

{

	struct ext4_ext_path *path = NULL, *ppath;

	struct ext4_ext_path *path;

	struct ext4_extent *ex;

	int ret;
@@ -5968,30 +5968,29 @@ int ext4_ext_replay_update_ex(struct inode *inode, ext4_lblk_t start, 
	if (le32_to_cpu(ex->ee_block) != start ||

		ext4_ext_get_actual_len(ex) != len) {

		/* We need to split this extent to match our extent first */

		ppath = path;

		down_write(&EXT4_I(inode)->i_data_sem);

		ret = ext4_force_split_extent_at(NULL, inode, &ppath, start, 1);

		ret = ext4_force_split_extent_at(NULL, inode, &path, start, 1);

		up_write(&EXT4_I(inode)->i_data_sem);

		if (ret)

			goto out;

		kfree(path);

		path = ext4_find_extent(inode, start, NULL, 0);



		path = ext4_find_extent(inode, start, &path, 0);

		if (IS_ERR(path))

			return -1;

		ppath = path;

			return PTR_ERR(path);

		ex = path[path->p_depth].p_ext;

		WARN_ON(le32_to_cpu(ex->ee_block) != start);



		if (ext4_ext_get_actual_len(ex) != len) {

			down_write(&EXT4_I(inode)->i_data_sem);

			ret = ext4_force_split_extent_at(NULL, inode, &ppath,

			ret = ext4_force_split_extent_at(NULL, inode, &path,

							 start + len, 1);

			up_write(&EXT4_I(inode)->i_data_sem);

			if (ret)

				goto out;

			kfree(path);

			path = ext4_find_extent(inode, start, NULL, 0);



			path = ext4_find_extent(inode, start, &path, 0);

			if (IS_ERR(path))

				return -EINVAL;

				return PTR_ERR(path);

			ex = path[path->p_depth].p_ext;

		}

	}