1 From fa30dde38aa8628c73a6dded7cb0bba38c27b576 Mon Sep 17 00:00:00 2001
2 From: Jiufei Xue <jiufei.xue@linux.alibaba.com>
3 Date: Thu, 14 Mar 2019 23:19:22 -0400
4 Subject: ext4: fix NULL pointer dereference while journal is aborted
6 From: Jiufei Xue <jiufei.xue@linux.alibaba.com>
8 commit fa30dde38aa8628c73a6dded7cb0bba38c27b576 upstream.
10 We see the following NULL pointer dereference while running xfstests
12 BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
13 PGD 8000000c84bad067 P4D 8000000c84bad067 PUD c84e62067 PMD 0
14 Oops: 0000 [#1] SMP PTI
15 CPU: 7 PID: 9886 Comm: fsstress Kdump: loaded Not tainted 5.0.0-rc8 #10
16 RIP: 0010:ext4_do_update_inode+0x4ec/0x760
19 ? jbd2_journal_get_write_access+0x42/0x50
20 ? __ext4_journal_get_write_access+0x2c/0x70
21 ? ext4_truncate+0x186/0x3f0
22 ext4_mark_iloc_dirty+0x61/0x80
23 ext4_mark_inode_dirty+0x62/0x1b0
24 ext4_truncate+0x186/0x3f0
25 ? unmap_mapping_pages+0x56/0x100
26 ext4_setattr+0x817/0x8b0
27 notify_change+0x1df/0x430
29 ? generic_permission+0x12b/0x1a0
31 This is triggered because the NULL pointer handle->h_transaction was
32 dereferenced in function ext4_update_inode_fsync_trans().
33 I found that the h_transaction was set to NULL in jbd2__journal_restart
34 but failed to attached to a new transaction while the journal is aborted.
36 Fix this by checking the handle before updating the inode.
38 Fixes: b436b9bef84d ("ext4: Wait for proper transaction commit on fsync")
39 Signed-off-by: Jiufei Xue <jiufei.xue@linux.alibaba.com>
40 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
41 Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
43 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
46 fs/ext4/ext4_jbd2.h | 2 +-
47 1 file changed, 1 insertion(+), 1 deletion(-)
49 --- a/fs/ext4/ext4_jbd2.h
50 +++ b/fs/ext4/ext4_jbd2.h
51 @@ -384,7 +384,7 @@ static inline void ext4_update_inode_fsy
53 struct ext4_inode_info *ei = EXT4_I(inode);
55 - if (ext4_handle_valid(handle)) {
56 + if (ext4_handle_valid(handle) && !is_handle_aborted(handle)) {
57 ei->i_sync_tid = handle->h_transaction->t_tid;
59 ei->i_datasync_tid = handle->h_transaction->t_tid;