From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Chao Yu <yuchao0@huawei.com>, Jaegeuk Kim <jaegeuk@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-f2fs-devel@lists.sourceforge.net
Subject: [PATCH AUTOSEL 5.5 083/106] f2fs: fix NULL pointer dereference in f2fs_write_begin()
Date: Wed, 15 Apr 2020 07:42:03 -0400 [thread overview]
Message-ID: <20200415114226.13103-83-sashal@kernel.org> (raw)
In-Reply-To: <20200415114226.13103-1-sashal@kernel.org>
From: Chao Yu <yuchao0@huawei.com>
[ Upstream commit 62f63eea291b50a5677ae7503ac128803174698a ]
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:f2fs_write_begin+0x823/0xb90 [f2fs]
Call Trace:
f2fs_quota_write+0x139/0x1d0 [f2fs]
write_blk+0x36/0x80 [quota_tree]
get_free_dqblk+0x42/0xa0 [quota_tree]
do_insert_tree+0x235/0x4a0 [quota_tree]
do_insert_tree+0x26e/0x4a0 [quota_tree]
do_insert_tree+0x26e/0x4a0 [quota_tree]
do_insert_tree+0x26e/0x4a0 [quota_tree]
qtree_write_dquot+0x70/0x190 [quota_tree]
v2_write_dquot+0x43/0x90 [quota_v2]
dquot_acquire+0x77/0x100
f2fs_dquot_acquire+0x2f/0x60 [f2fs]
dqget+0x310/0x450
dquot_transfer+0x7e/0x120
f2fs_setattr+0x11a/0x4a0 [f2fs]
notify_change+0x349/0x480
chown_common+0x168/0x1c0
do_fchownat+0xbc/0xf0
__x64_sys_fchownat+0x20/0x30
do_syscall_64+0x5f/0x220
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Passing fsdata parameter to .write_{begin,end} in f2fs_quota_write(),
so that if quota file is compressed one, we can avoid above NULL
pointer dereference when updating quota content.
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/super.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index b2f8b934d8fc5..0ed437dc53ecc 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1826,6 +1826,7 @@ static ssize_t f2fs_quota_write(struct super_block *sb, int type,
int offset = off & (sb->s_blocksize - 1);
size_t towrite = len;
struct page *page;
+ void *fsdata = NULL;
char *kaddr;
int err = 0;
int tocopy;
@@ -1835,7 +1836,7 @@ static ssize_t f2fs_quota_write(struct super_block *sb, int type,
towrite);
retry:
err = a_ops->write_begin(NULL, mapping, off, tocopy, 0,
- &page, NULL);
+ &page, &fsdata);
if (unlikely(err)) {
if (err == -ENOMEM) {
congestion_wait(BLK_RW_ASYNC, HZ/50);
@@ -1851,7 +1852,7 @@ static ssize_t f2fs_quota_write(struct super_block *sb, int type,
flush_dcache_page(page);
a_ops->write_end(NULL, mapping, off, tocopy, tocopy,
- page, NULL);
+ page, fsdata);
offset = 0;
towrite -= tocopy;
off += tocopy;
--
2.20.1
next prev parent reply other threads:[~2020-04-15 12:37 UTC|newest]
Thread overview: 106+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-15 11:40 [PATCH AUTOSEL 5.5 001/106] drm/ttm: flush the fence on the bo after we individualize the reservation object Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 002/106] gfs2: clear ail1 list when gfs2 withdraws Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 003/106] clk: Don't cache errors from clk_ops::get_phase() Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 004/106] clk: at91: usb: continue if clk_hw_round_rate() return zero Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 005/106] clk: imx: pll14xx: Add new frequency entries for pll1443x table Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 006/106] net/mlx5e: Enforce setting of a single FEC mode Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 007/106] s390/crypto: explicitly memzero stack key material in aes_s390.c Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 008/106] f2fs: fix the panic in do_checkpoint() Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 009/106] bpf: Reliably preserve btf_trace_xxx types Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 010/106] xfs: fix iclog release error check race with shutdown Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 011/106] arm64: dts: librem5-devkit: add a vbus supply to usb0 Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 012/106] ARM: dts: rockchip: fix vqmmc-supply property name for rk3188-bqedison2qc Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 013/106] arm64: dts: allwinner: a64: Fix display clock register range Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 014/106] power: supply: bq27xxx_battery: Silence deferred-probe error Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 015/106] clk: tegra: Fix Tegra PMC clock out parents Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 016/106] arm64: tegra: Add PCIe endpoint controllers nodes for Tegra194 Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 017/106] arm64: tegra: Fix Tegra194 PCIe compatible string Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 018/106] xfs: fix use-after-free when aborting corrupt attr inactivation Sasha Levin
2020-04-15 11:40 ` [PATCH AUTOSEL 5.5 019/106] xfs: fix regression in "cleanup xfs_dir2_block_getdents" Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 020/106] arm64: dts: marvell: espressobin: add ethernet alias Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 021/106] arm64: dts: clearfog-gt-8k: set gigabit PHY reset deassert delay Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 022/106] arm64: dts: marvell: Fix cpu compatible for AP807-quad Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 023/106] soc: imx: gpc: fix power up sequencing Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 024/106] dma-coherent: fix integer overflow in the reserved-memory dma allocation Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 025/106] rtc: 88pm860x: fix possible race condition Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 026/106] NFS: alloc_nfs_open_context() must use the file cred when available Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 027/106] NFSv4/pnfs: Return valid stateids in nfs_layout_find_inode_by_stateid() Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 028/106] NFSv4.2: error out when relink swapfile Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 029/106] ARM: dts: rockchip: fix lvds-encoder ports subnode for rk3188-bqedison2qc Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 030/106] xfs: fix incorrect test in xfs_alloc_ag_vextent_lastblock Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 031/106] KVM: PPC: Book3S HV: Fix H_CEDE return code for nested guests Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 032/106] f2fs: fix to show norecovery mount option Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 033/106] drivers: thermal: tsens: Release device in success path Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 034/106] phy: uniphier-usb3ss: Add Pro5 support Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 035/106] NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context fails Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 036/106] f2fs: fix to update f2fs_super_block fields under sb_lock Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 037/106] f2fs: Fix mount failure due to SPO after a successful online resize FS Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 038/106] f2fs: Add a new CP flag to help fsck fix resize SPO issues Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 039/106] s390/cpuinfo: fix wrong output when CPU0 is offline Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 040/106] MIPS: DTS: CI20: add DT node for IR sensor Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 041/106] thermal/drivers/cpufreq_cooling: Fix return of cpufreq_set_cur_state Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 042/106] hibernate: Allow uswsusp to write to swap Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 043/106] btrfs: handle NULL roots in btrfs_put/btrfs_grab_fs_root Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 044/106] btrfs: add RCU locks around block group initialization Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 045/106] powerpc/prom_init: Pass the "os-term" message to hypervisor Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 046/106] powerpc/maple: Fix declaration made after definition Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 047/106] s390/cpum_sf: Fix wrong page count in error message Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 048/106] ext4: do not commit super on read-only bdev Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 049/106] ext4: fix incorrect group count in ext4_fill_super error message Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 050/106] ext4: fix incorrect inodes per group in " Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 051/106] um: ubd: Prevent buffer overrun on command completion Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 052/106] cifs: Allocate encryption header through kmalloc Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 053/106] x86/xen: Make the boot CPU idle task reliable Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 054/106] dt-bindings: thermal: tsens: Fix nvmem-cell-names schema Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 055/106] net: phy: at803x: fix clock sink configuration on ATH8030 and ATH8035 Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 056/106] cxgb4: fix MPS index overwrite when setting MAC address Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 057/106] slcan: Don't transmit uninitialized stack data in padding Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 058/106] net: qualcomm: rmnet: Allow configuration updates to existing devices Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 059/106] mm/hugetlb: fix build failure with HUGETLB_PAGE but not HUGEBTLBFS Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 060/106] net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 061/106] net: dsa: mt7530: fix null pointer dereferencing in port5 setup Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 062/106] tun: Don't put_page() for all negative return values from XDP program Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 063/106] mlxsw: spectrum_flower: Do not stop at FLOW_ACTION_VLAN_MANGLE Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 064/106] net: dsa: bcm_sf2: Do not register slave MDIO bus with OF Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 065/106] drm/nouveau/svm: check for SVM initialized before migrating Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 066/106] drm/nouveau/svm: fix vma range check for migration Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 067/106] include/linux/swapops.h: correct guards for non_swap_entry() Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 068/106] percpu_counter: fix a data race at vm_committed_as Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 069/106] linux/bits.h: add compile time sanity check of GENMASK inputs Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 070/106] compiler.h: fix error in BUILD_BUG_ON() reporting Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 071/106] KVM: s390: vsie: Fix possible race when shadowing region 3 tables Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 072/106] drm/nouveau: workaround runpm fail by disabling PCI power management on certain intel bridges Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 073/106] leds: core: Fix warning message when init_data Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 074/106] net: dsa: bcm_sf2: Ensure correct sub-node is parsed Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 075/106] x86: ACPI: fix CPU hotplug deadlock Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 076/106] net: phy: micrel: kszphy_resume(): add delay after genphy_resume() before accessing PHY registers Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 077/106] csky: Fixup cpu speculative execution to IO area Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 078/106] net: stmmac: xgmac: Fix VLAN register handling Sasha Levin
2020-04-15 11:41 ` [PATCH AUTOSEL 5.5 079/106] drm/amdkfd: kfree the wrong pointer Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 080/106] cxgb4: free MQPRIO resources in shutdown path Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 081/106] NFS: Fix memory leaks in nfs_pageio_stop_mirroring() Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 082/106] csky: Fixup get wrong psr value from phyical reg Sasha Levin
2020-04-15 11:42 ` Sasha Levin [this message]
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 084/106] ACPICA: Fixes for acpiExec namespace init file Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 085/106] mfd: dln2: Fix sanity checking for endpoints Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 086/106] um: falloc.h needs to be directly included for older libc Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 087/106] drm/vc4: Fix HDMI mode validation Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 088/106] iommu/virtio: Fix freeing of incomplete domains Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 089/106] iommu/vt-d: Fix mm reference leak Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 090/106] SUNRPC: fix krb5p mount to provide large enough buffer in rq_rcvsize Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 091/106] virtio-balloon: Switch back to OOM handler for VIRTIO_BALLOON_F_DEFLATE_ON_OOM Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 092/106] ext2: fix empty body warnings when -Wextra is used Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 093/106] f2fs: skip GC when section is full Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 094/106] iommu/vt-d: Silence RCU-list debugging warning in dmar_find_atsr() Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 095/106] iommu/vt-d: Fix page request descriptor size Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 096/106] ovl: fix value of i_ino for lower hardlink corner case Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 097/106] ext2: fix debug reference to ext2_xattr_cache Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 098/106] sunrpc: Fix gss_unwrap_resp_integ() again Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 099/106] csky: Fixup init_fpu compile warning with __init Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 100/106] power: supply: axp288_fuel_gauge: Broaden vendor check for Intel Compute Sticks Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 101/106] platform/chrome: cros_ec_rpmsg: Fix race with host event Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 102/106] libnvdimm: Out of bounds read in __nd_ioctl() Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 103/106] acpi/nfit: improve bounds checking for 'func' Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 104/106] iommu/amd: Fix the configuration of GCR3 table root pointer Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 105/106] f2fs: fix to wait all node page writeback Sasha Levin
2020-04-15 11:42 ` [PATCH AUTOSEL 5.5 106/106] platform/chrome: cros_ec: Query EC protocol version if EC transitions between RO/RW Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200415114226.13103-83-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jaegeuk@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yuchao0@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).