queue-4.19/ext4-fix-null-pointer-dereference-while-journal-is-aborted.patch

   1 From fa30dde38aa8628c73a6dded7cb0bba38c27b576 Mon Sep 17 00:00:00 2001
   2 From: Jiufei Xue <jiufei.xue@linux.alibaba.com>
   3 Date: Thu, 14 Mar 2019 23:19:22 -0400
   4 Subject: ext4: fix NULL pointer dereference while journal is aborted
   5
   6 From: Jiufei Xue <jiufei.xue@linux.alibaba.com>
   7
   8 commit fa30dde38aa8628c73a6dded7cb0bba38c27b576 upstream.
   9
  10 We see the following NULL pointer dereference while running xfstests
  11 generic/475:
  12 BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
  13 PGD 8000000c84bad067 P4D 8000000c84bad067 PUD c84e62067 PMD 0
  14 Oops: 0000 [#1] SMP PTI
  15 CPU: 7 PID: 9886 Comm: fsstress Kdump: loaded Not tainted 5.0.0-rc8 #10
  16 RIP: 0010:ext4_do_update_inode+0x4ec/0x760
  17 ...
  18 Call Trace:
  19 ? jbd2_journal_get_write_access+0x42/0x50
  20 ? __ext4_journal_get_write_access+0x2c/0x70
  21 ? ext4_truncate+0x186/0x3f0
  22 ext4_mark_iloc_dirty+0x61/0x80
  23 ext4_mark_inode_dirty+0x62/0x1b0
  24 ext4_truncate+0x186/0x3f0
  25 ? unmap_mapping_pages+0x56/0x100
  26 ext4_setattr+0x817/0x8b0
  27 notify_change+0x1df/0x430
  28 do_truncate+0x5e/0x90
  29 ? generic_permission+0x12b/0x1a0
  30
  31 This is triggered because the NULL pointer handle->h_transaction was
  32 dereferenced in function ext4_update_inode_fsync_trans().
  33 I found that the h_transaction was set to NULL in jbd2__journal_restart
  34 but failed to attached to a new transaction while the journal is aborted.
  35
  36 Fix this by checking the handle before updating the inode.
  37
  38 Fixes: b436b9bef84d ("ext4: Wait for proper transaction commit on fsync")
  39 Signed-off-by: Jiufei Xue <jiufei.xue@linux.alibaba.com>
  40 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  41 Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
  42 Cc: stable@kernel.org
  43 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  44
  45 ---
  46  fs/ext4/ext4_jbd2.h |    2 +-
  47  1 file changed, 1 insertion(+), 1 deletion(-)
  48
  49 --- a/fs/ext4/ext4_jbd2.h
  50 +++ b/fs/ext4/ext4_jbd2.h
  51 @@ -384,7 +384,7 @@ static inline void ext4_update_inode_fsy
  52  {
  53         struct ext4_inode_info *ei = EXT4_I(inode);
  54
  55 -       if (ext4_handle_valid(handle)) {
  56 +       if (ext4_handle_valid(handle) && !is_handle_aborted(handle)) {
  57                 ei->i_sync_tid = handle->h_transaction->t_tid;
  58                 if (datasync)
  59                         ei->i_datasync_tid = handle->h_transaction->t_tid;