* [PATCH ] ext3: Fix a possible corruption in dx_probe.
@ 2011-08-31 15:57 Tao Ma
2011-09-01 16:43 ` Jan Kara
0 siblings, 1 reply; 2+ messages in thread
From: Tao Ma @ 2011-08-31 15:57 UTC (permalink / raw)
To: linux-ext4; +Cc: Jan Kara
From: Tao Ma <boyu.mt@taobao.com>
For all the callers of dx_probe, frame_in is passed in uninitialized.
So we should set frame->bh to NULL in the beginning of while, not
the end. Otherwise, the first "goto fail2" will try to brelse(frame->bh)
while frame->bh is still invalid.
Cc: Jan Kara <jack@suse.cz>
Signed-off-by: Tao Ma <boyu.mt@taobao.com>
---
fs/ext3/namei.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 34b6d9b..45468b9 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -404,6 +404,7 @@ dx_probe(struct qstr *entry, struct inode *dir,
dxtrace (printk("Look up %x", hash));
while (1)
{
+ frame->bh = NULL;
count = dx_get_count(entries);
if (!count || count > dx_get_limit(entries)) {
ext3_warning(dir->i_sb, __func__,
@@ -458,7 +459,6 @@ dx_probe(struct qstr *entry, struct inode *dir,
goto fail2;
}
frame++;
- frame->bh = NULL;
}
fail2:
while (frame >= frame_in) {
--
1.7.0.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH ] ext3: Fix a possible corruption in dx_probe.
2011-08-31 15:57 [PATCH ] ext3: Fix a possible corruption in dx_probe Tao Ma
@ 2011-09-01 16:43 ` Jan Kara
0 siblings, 0 replies; 2+ messages in thread
From: Jan Kara @ 2011-09-01 16:43 UTC (permalink / raw)
To: Tao Ma; +Cc: linux-ext4, Jan Kara
On Wed 31-08-11 23:57:24, Tao Ma wrote:
> From: Tao Ma <boyu.mt@taobao.com>
>
> For all the callers of dx_probe, frame_in is passed in uninitialized.
> So we should set frame->bh to NULL in the beginning of while, not
> the end. Otherwise, the first "goto fail2" will try to brelse(frame->bh)
> while frame->bh is still invalid.
I think this happens at the beginning of dx_probe().
Honza
>
> Cc: Jan Kara <jack@suse.cz>
> Signed-off-by: Tao Ma <boyu.mt@taobao.com>
> ---
> fs/ext3/namei.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
> index 34b6d9b..45468b9 100644
> --- a/fs/ext3/namei.c
> +++ b/fs/ext3/namei.c
> @@ -404,6 +404,7 @@ dx_probe(struct qstr *entry, struct inode *dir,
> dxtrace (printk("Look up %x", hash));
> while (1)
> {
> + frame->bh = NULL;
> count = dx_get_count(entries);
> if (!count || count > dx_get_limit(entries)) {
> ext3_warning(dir->i_sb, __func__,
> @@ -458,7 +459,6 @@ dx_probe(struct qstr *entry, struct inode *dir,
> goto fail2;
> }
> frame++;
> - frame->bh = NULL;
> }
> fail2:
> while (frame >= frame_in) {
> --
> 1.7.0.4
>
--
Jan Kara <jack@suse.cz>
SUSE Labs, CR
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-09-01 16:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-08-31 15:57 [PATCH ] ext3: Fix a possible corruption in dx_probe Tao Ma
2011-09-01 16:43 ` Jan Kara
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.