* [PATCH] ext4: Fix a possible corruption in dx_probe.
@ 2011-08-31 16:00 Tao Ma
2011-09-04 13:57 ` Ted Ts'o
0 siblings, 1 reply; 3+ messages in thread
From: Tao Ma @ 2011-08-31 16:00 UTC (permalink / raw)
To: linux-ext4; +Cc: Theodore Ts'o
From: Tao Ma <boyu.mt@taobao.com>
For all the callers of dx_probe, frame_in is passed in uninitialized.
So we should set frame->bh to NULL in the beginning of while, not
the end. Otherwise, the first "goto fail2" will try to brelse(frame->bh)
while frame->bh is still invalid.
Cc: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Tao Ma <boyu.mt@taobao.com>
---
fs/ext4/namei.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index b754b77..86c5c69 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -404,6 +404,7 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
dxtrace(printk("Look up %x", hash));
while (1)
{
+ frame->bh = NULL;
count = dx_get_count(entries);
if (!count || count > dx_get_limit(entries)) {
ext4_warning(dir->i_sb,
@@ -458,7 +459,6 @@ dx_probe(const struct qstr *d_name, struct inode *dir,
goto fail2;
}
frame++;
- frame->bh = NULL;
}
fail2:
while (frame >= frame_in) {
--
1.7.0.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] ext4: Fix a possible corruption in dx_probe.
2011-08-31 16:00 [PATCH] ext4: Fix a possible corruption in dx_probe Tao Ma
@ 2011-09-04 13:57 ` Ted Ts'o
2011-09-05 2:17 ` Tao Ma
0 siblings, 1 reply; 3+ messages in thread
From: Ted Ts'o @ 2011-09-04 13:57 UTC (permalink / raw)
To: Tao Ma; +Cc: linux-ext4
On Thu, Sep 01, 2011 at 12:00:52AM +0800, Tao Ma wrote:
> From: Tao Ma <boyu.mt@taobao.com>
>
> For all the callers of dx_probe, frame_in is passed in uninitialized.
> So we should set frame->bh to NULL in the beginning of while, not
> the end. Otherwise, the first "goto fail2" will try to brelse(frame->bh)
> while frame->bh is still invalid.
There's a "frame->bh = NULL" statement at the very beginning of
dx_probe(). Shouldn't that do the trick?
- Ted
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] ext4: Fix a possible corruption in dx_probe.
2011-09-04 13:57 ` Ted Ts'o
@ 2011-09-05 2:17 ` Tao Ma
0 siblings, 0 replies; 3+ messages in thread
From: Tao Ma @ 2011-09-05 2:17 UTC (permalink / raw)
To: Ted Ts'o; +Cc: linux-ext4, Jan Kara
On 09/04/2011 09:57 PM, Ted Ts'o wrote:
> On Thu, Sep 01, 2011 at 12:00:52AM +0800, Tao Ma wrote:
>> From: Tao Ma <boyu.mt@taobao.com>
>>
>> For all the callers of dx_probe, frame_in is passed in uninitialized.
>> So we should set frame->bh to NULL in the beginning of while, not
>> the end. Otherwise, the first "goto fail2" will try to brelse(frame->bh)
>> while frame->bh is still invalid.
>
> There's a "frame->bh = NULL" statement at the very beginning of
> dx_probe(). Shouldn't that do the trick?
Oh, sorry for the false alarm.
Thanks
Tao
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-09-05 2:17 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-08-31 16:00 [PATCH] ext4: Fix a possible corruption in dx_probe Tao Ma
2011-09-04 13:57 ` Ted Ts'o
2011-09-05 2:17 ` Tao Ma
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).