[PATCH] ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()

[PATCH] ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()

[Eryu Guan]

ext4_reserve_inode_write() in ext4_mark_inode_dirty() could fail on
error (e.g. EIO) and iloc.bh can be NULL in this case. But the error is
ignored in the following "if" condition and ext4_expand_extra_isize()
might be called with NULL iloc.bh set, which triggers NULL pointer
dereference.

This is uncovered by commit 8b4953e13f4c ("ext4: reserve code points for
the project quota feature"), which enlarges the ext4_inode size, and
run the following script on new kernel but with old mke2fs:

  #/bin/bash
  mnt=/mnt/ext4
  devname=ext4-error
  dev=/dev/mapper/$devname
  fsimg=/home/fs.img

  trap cleanup 0 1 2 3 9 15

  cleanup()
  {
          umount $mnt >/dev/null 2>&1
          dmsetup remove $devname
          losetup -d $backend_dev
          rm -f $fsimg
          exit 0
  }

  rm -f $fsimg
  fallocate -l 1g $fsimg
  backend_dev=`losetup -f --show $fsimg`
  devsize=`blockdev --getsz $backend_dev`

  good_tab="0 $devsize linear $backend_dev 0"
  error_tab="0 $devsize error $backend_dev 0"

  dmsetup create $devname --table "$good_tab"

  mkfs -t ext4 $dev
  mount -t ext4 -o errors=continue,strictatime $dev $mnt

  dmsetup load $devname --table "$error_tab" && dmsetup resume $devname
  echo 3 > /proc/sys/vm/drop_caches
  ls -l $mnt
  exit 0

Signed-off-by: Eryu Guan <guaneryu@gmail.com>
---
 fs/ext4/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index aee960b..f1f26ea 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5261,7 +5261,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
 	might_sleep();
 	trace_ext4_mark_inode_dirty(inode, _RET_IP_);
 	err = ext4_reserve_inode_write(handle, inode, &iloc);
-	if (ext4_handle_valid(handle) &&
+	if (!err && ext4_handle_valid(handle) &&
 	    EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize &&
 	    !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) {
 		/*
-- 
2.5.0

Re: [PATCH] ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()

[Theodore Ts'o]

On Fri, Mar 11, 2016 at 11:38:53PM +0800, Eryu Guan wrote:
> ext4_reserve_inode_write() in ext4_mark_inode_dirty() could fail on
> error (e.g. EIO) and iloc.bh can be NULL in this case. But the error is
> ignored in the following "if" condition and ext4_expand_extra_isize()
> might be called with NULL iloc.bh set, which triggers NULL pointer
> dereference.

Nice catch!  I'm going fix this slightly differently (although I'll
keep your description).  The patch is a wee bit bigger, but the end
result is simpler to read.

Thanks,

						- Ted

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ce2c4c6..b41432e 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5312,6 +5312,8 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
 	might_sleep();
 	trace_ext4_mark_inode_dirty(inode, _RET_IP_);
 	err = ext4_reserve_inode_write(handle, inode, &iloc);
+	if (err)
+		return err;
 	if (ext4_handle_valid(handle) &&
 	    EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize &&
 	    !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) {
@@ -5342,9 +5344,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
 			}
 		}
 	}
-	if (!err)
-		err = ext4_mark_iloc_dirty(handle, inode, &iloc);
-	return err;
+	return ext4_mark_iloc_dirty(handle, inode, &iloc);
 }
 
 /*

Re: [PATCH] ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()

[Eryu Guan]

On Sat, Mar 12, 2016 at 09:39:22PM -0500, Theodore Ts'o wrote:
> On Fri, Mar 11, 2016 at 11:38:53PM +0800, Eryu Guan wrote:
> > ext4_reserve_inode_write() in ext4_mark_inode_dirty() could fail on
> > error (e.g. EIO) and iloc.bh can be NULL in this case. But the error is
> > ignored in the following "if" condition and ext4_expand_extra_isize()
> > might be called with NULL iloc.bh set, which triggers NULL pointer
> > dereference.
> 
> Nice catch!  I'm going fix this slightly differently (although I'll
> keep your description).  The patch is a wee bit bigger, but the end
> result is simpler to read.

Yes, it's more easier to read. Thanks!

Eryu

> 
> Thanks,
> 
> 						- Ted
> 
> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> index ce2c4c6..b41432e 100644
> --- a/fs/ext4/inode.c
> +++ b/fs/ext4/inode.c
> @@ -5312,6 +5312,8 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
>  	might_sleep();
>  	trace_ext4_mark_inode_dirty(inode, _RET_IP_);
>  	err = ext4_reserve_inode_write(handle, inode, &iloc);
> +	if (err)
> +		return err;
>  	if (ext4_handle_valid(handle) &&
>  	    EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize &&
>  	    !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) {
> @@ -5342,9 +5344,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
>  			}
>  		}
>  	}
> -	if (!err)
> -		err = ext4_mark_iloc_dirty(handle, inode, &iloc);
> -	return err;
> +	return ext4_mark_iloc_dirty(handle, inode, &iloc);
>  }
>  
>  /*