Dan Carpenter 37b0b6b8b9 ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() ...

If sbi->s_flex_groups_allocated is zero and the first allocation fails
then this code will crash.  The problem is that "i--" will set "i" to
-1 but when we compare "i >= sbi->s_flex_groups_allocated" then the -1
is type promoted to unsigned and becomes UINT_MAX.  Since UINT_MAX
is more than zero, the condition is true so we call kvfree(new_groups[-1]).
The loop will carry on freeing invalid memory until it crashes.

Fixes: 7c990728b9 ("ext4: fix potential race between s_flex_groups online resizing and access")
Reviewed-by: Suraj Jitindar Singh <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Cc: [email protected]
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Theodore Ts'o <[email protected]>

2020-02-29 17:48:08 -05:00

..

acl.c

…

acl.h

…

balloc.c

ext4: fix potential race between online resizing and write operations

2020-02-21 00:37:09 -05:00

bitmap.c

…

block_validity.c

ext4: add cond_resched() to ext4_protect_reserved_inode

2020-02-13 11:56:26 -05:00

dir.c

ext4: fix checksum errors with indexed dirs

2020-02-13 11:56:19 -05:00

ext4_extents.h

ext4: make some functions static in extents.c

2020-01-17 16:24:54 -05:00

ext4_jbd2.c

ext4: uninline ext4_inode_journal_mode()

2020-01-17 16:24:52 -05:00

ext4_jbd2.h

ext4: uninline ext4_inode_journal_mode()

2020-01-17 16:24:52 -05:00

ext4.h

ext4: fix race between writepages and enabling EXT4_EXTENTS_FL

2020-02-21 19:32:07 -05:00

extents_status.c

…

extents_status.h

ext4: fix extent_status trace points

2020-01-25 02:03:03 -05:00

extents.c

ext4: fix extent_status fragmentation for plain files

2020-01-23 12:02:15 -05:00

file.c

…

fsmap.c

…

fsmap.h

…

fsync.c

…

hash.c

…

ialloc.c

ext4: fix potential race between s_flex_groups online resizing and access

2020-02-21 19:31:46 -05:00

indirect.c

ext4: remove ext4_{ind,ext}_calc_metadata_amount()

2020-01-17 16:24:54 -05:00

inline.c

ext4,jbd2: fix comment and code style

2020-01-25 02:24:53 -05:00

inode-test.c

…

inode.c

ext4: rename s_journal_flag_rwsem to s_writepages_rwsem

2020-02-21 19:32:07 -05:00

ioctl.c

ext4: Add EXT4_IOC_FSGETXATTR/EXT4_IOC_FSSETXATTR to compat_ioctl

2020-01-17 16:24:55 -05:00

Kconfig

Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

2020-01-30 15:17:05 -08:00

Makefile

…

mballoc.c

ext4: fix potential race between s_flex_groups online resizing and access

2020-02-21 19:31:46 -05:00

mballoc.h

…

migrate.c

ext4: fix race between writepages and enabling EXT4_EXTENTS_FL

2020-02-21 19:32:07 -05:00

mmp.c

ext4: don't assume that mmp_nodename/bdevname have NUL

2020-02-13 11:53:10 -05:00

move_extent.c

…

namei.c

ext4: add cond_resched() to __ext4_find_entry()

2020-02-19 23:53:52 -05:00

page-io.c

ext4: fix deadlock allocating crypto bounce page from mempool

2020-01-17 16:24:54 -05:00

readpage.c

ext4: remove unneeded check for error allocating bio_post_read_ctx

2020-01-17 16:24:54 -05:00

resize.c

ext4: fix potential race between s_flex_groups online resizing and access

2020-02-21 19:31:46 -05:00

super.c

ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()

2020-02-29 17:48:08 -05:00

symlink.c

…

sysfs.c

…

truncate.h

…

verity.c

fs-verity: implement readahead of Merkle tree pages

2020-01-14 13:27:32 -08:00

xattr_security.c

…

xattr_trusted.c

…

xattr_user.c

…

xattr.c

ext4: drop ext4_kvmalloc()

2020-01-17 16:24:55 -05:00

xattr.h

…