]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
6.9-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 16 Jul 2024 13:15:31 +0000 (15:15 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 16 Jul 2024 13:15:31 +0000 (15:15 +0200)
added patches:
ext4-avoid-ptr-null-pointer-dereference.patch

queue-6.9/ext4-avoid-ptr-null-pointer-dereference.patch [new file with mode: 0644]
queue-6.9/series

diff --git a/queue-6.9/ext4-avoid-ptr-null-pointer-dereference.patch b/queue-6.9/ext4-avoid-ptr-null-pointer-dereference.patch
new file mode 100644 (file)
index 0000000..da06000
--- /dev/null
@@ -0,0 +1,35 @@
+From libaokun@huaweicloud.com  Tue Jul 16 15:13:28 2024
+From: libaokun@huaweicloud.com
+Date: Tue, 16 Jul 2024 17:29:29 +0800
+Subject: ext4: avoid ptr null pointer dereference
+To: stable@vger.kernel.org, gregkh@linuxfoundation.org
+Cc: sashal@kernel.org, tytso@mit.edu, jack@suse.cz, patches@lists.linux.dev, yi.zhang@huawei.com, yangerkun@huawei.com, libaokun@huaweicloud.com, Baokun Li <libaokun1@huawei.com>
+Message-ID: <20240716092929.864207-1-libaokun@huaweicloud.com>
+
+From: Baokun Li <libaokun1@huawei.com>
+
+When commit 13df4d44a3aa ("ext4: fix slab-out-of-bounds in
+ext4_mb_find_good_group_avg_frag_lists()") was backported to stable, the
+commit f536808adcc3 ("ext4: refactor out ext4_generic_attr_store()") that
+uniformly determines if the ptr is null is not merged in, so it needs to
+be judged whether ptr is null or not in each case of the switch, otherwise
+null pointer dereferencing may occur.
+
+Fixes: b829687ae122 ("ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()")
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/sysfs.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/ext4/sysfs.c
++++ b/fs/ext4/sysfs.c
+@@ -473,6 +473,8 @@ static ssize_t ext4_attr_store(struct ko
+                       *((unsigned int *) ptr) = t;
+               return len;
+       case attr_clusters_in_group:
++              if (!ptr)
++                      return 0;
+               ret = kstrtouint(skip_spaces(buf), 0, &t);
+               if (ret)
+                       return ret;
index 7176761601fcce3d5009962ac7c74d2587a64ce8..91d3d11bcaa12cf10f9bc7b7bbbef016015065cf 100644 (file)
@@ -131,3 +131,4 @@ mm-readahead-limit-page-cache-size-in-page_cache_ra_order.patch
 mm-shmem-disable-pmd-sized-page-cache-if-needed.patch
 mm-damon-core-merge-regions-aggressively-when-max_nr_regions-is-unmet.patch
 revert-dt-bindings-cache-qcom-llcc-correct-qdu1000-reg-entries.patch
+ext4-avoid-ptr-null-pointer-dereference.patch