linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Raghavendra K T <raghavendra.kt@linux.vnet.ibm.com>
To: Alexander Viro <viro@zeniv.linux.org.uk>,
	Matias Bjorling <m@bjorling.me>, Jens Axboe <axboe@kernel.dk>,
	Andrew Morton <akpm@linux-foundation.org>,
	Yuanhan Liu <yuanhan.liu@linux.intel.com>,
	"Darrick J. Wong" <darrick.wong@oracle.com>,
	Jan Kara <jack@suse.cz>, Johannes Weiner <hannes@cmpxchg.org>,
	Zhang Yanfei <zhangyanfei@cn.fujitsu.com>,
	Jeff <jmoyer@redhat.com>
Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	Raghavendra K T <raghavendra.kt@linux.vnet.ibm.com>,
	Sumanth <sumantk2@linux.vnet.ibm.com>
Subject: [RFC PATCH V3 2/2] fs : Add sanity checks for block size > PAGE_SIZE
Date: Tue, 21 Jan 2014 17:00:00 +0530	[thread overview]
Message-ID: <1390303800-22422-3-git-send-email-raghavendra.kt@linux.vnet.ibm.com> (raw)
In-Reply-To: <1390303800-22422-1-git-send-email-raghavendra.kt@linux.vnet.ibm.com>

We could hit null pointer dereference error during alloc_page_buffers
in : (1) block size > PAGE_SIZE (2) low memory.
Add sanity check for that.

Signed-off-by: Raghavendra K T <raghavendra.kt@linux.vnet.ibm.com>
---
 fs/block_dev.c | 1 +
 fs/buffer.c    | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/fs/block_dev.c b/fs/block_dev.c
index 1e86823..2481d42 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1027,6 +1027,7 @@ void bd_set_size(struct block_device *bdev, loff_t size)
 			break;
 		bsize <<= 1;
 	}
+	BUG_ON(bsize > PAGE_SIZE);
 	bdev->bd_block_size = bsize;
 	bdev->bd_inode->i_blkbits = blksize_bits(bsize);
 }
diff --git a/fs/buffer.c b/fs/buffer.c
index 6024877..b039b15 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1571,6 +1571,12 @@ void create_empty_buffers(struct page *page,
 	struct buffer_head *bh, *head, *tail;
 
 	head = alloc_page_buffers(page, blocksize, 1);
+
+	/*
+ 	 * alloc_page_buffers() could return NULL on (1) bs > PAGE_SIZE
+ 	 * (2) low memory case. Ensure that we don't dereference null ptr
+ 	 */  
+	BUG_ON(!head);
 	bh = head;
 	do {
 		bh->b_state |= b_state;
-- 
1.7.11.7

  parent reply	other threads:[~2014-01-21 11:30 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-01-21 11:29 [RFC PATCH V3 0/2] Fix null pointer deference problem Raghavendra K T
2014-01-21 11:29 ` [RFC PATCH V3 1/2] null_blk: Null pointer deference problem in alloc_page_buffers Raghavendra K T
2014-01-21 17:13   ` Matias Bjorling
2014-01-22  4:22   ` Jens Axboe
2014-01-21 11:30 ` Raghavendra K T [this message]
2014-01-21 17:13   ` [RFC PATCH V3 2/2] fs : Add sanity checks for block size > PAGE_SIZE Matias Bjorling
2014-01-21 20:21   ` Andrew Morton
2014-01-22  6:52     ` Raghavendra K T

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1390303800-22422-3-git-send-email-raghavendra.kt@linux.vnet.ibm.com \
    --to=raghavendra.kt@linux.vnet.ibm.com \
    --cc=akpm@linux-foundation.org \
    --cc=axboe@kernel.dk \
    --cc=darrick.wong@oracle.com \
    --cc=hannes@cmpxchg.org \
    --cc=jack@suse.cz \
    --cc=jmoyer@redhat.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=m@bjorling.me \
    --cc=sumantk2@linux.vnet.ibm.com \
    --cc=viro@zeniv.linux.org.uk \
    --cc=yuanhan.liu@linux.intel.com \
    --cc=zhangyanfei@cn.fujitsu.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).