From mboxrd@z Thu Jan  1 00:00:00 1970
From: Matias Bjorling <m@bjorling.me>
Subject: Re: [RFC PATCH V3 2/2] fs : Add sanity checks for block size > PAGE_SIZE
Date: Tue, 21 Jan 2014 09:13:43 -0800
Message-ID: <52DEAAC7.7070903@bjorling.me>
References: <1390303800-22422-1-git-send-email-raghavendra.kt@linux.vnet.ibm.com> <1390303800-22422-3-git-send-email-raghavendra.kt@linux.vnet.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	Sumanth <sumantk2@linux.vnet.ibm.com>
To: Raghavendra K T <raghavendra.kt@linux.vnet.ibm.com>,
	Alexander Viro <viro@zeniv.linux.org.uk>,
	Jens Axboe <axboe@kernel.dk>,
	Andrew Morton <akpm@linux-foundation.org>,
	Yuanhan Liu <yuanhan.liu@linux.intel.com>,
	"Darrick J. Wong" <darrick.wong@oracle.com>,
	Jan Kara <jack@suse.cz>, Johannes Weiner <hannes@cmpxchg.org>,
	Zhang Yanfei <zhangyanfei@cn.fujitsu.com>,
	Jeff <jmoyer@redhat.com>
Return-path: <linux-kernel-owner@vger.kernel.org>
In-Reply-To: <1390303800-22422-3-git-send-email-raghavendra.kt@linux.vnet.ibm.com>
Sender: linux-kernel-owner@vger.kernel.org
List-Id: linux-fsdevel.vger.kernel.org

On 01/21/2014 03:30 AM, Raghavendra K T wrote:
> We could hit null pointer dereference error during alloc_page_buffers
> in : (1) block size > PAGE_SIZE (2) low memory.
> Add sanity check for that.
> 
> Signed-off-by: Raghavendra K T <raghavendra.kt@linux.vnet.ibm.com>
> ---
>  fs/block_dev.c | 1 +
>  fs/buffer.c    | 6 ++++++
>  2 files changed, 7 insertions(+)
> 
> diff --git a/fs/block_dev.c b/fs/block_dev.c
> index 1e86823..2481d42 100644
> --- a/fs/block_dev.c
> +++ b/fs/block_dev.c
> @@ -1027,6 +1027,7 @@ void bd_set_size(struct block_device *bdev, loff_t size)
>  			break;
>  		bsize <<= 1;
>  	}
> +	BUG_ON(bsize > PAGE_SIZE);
>  	bdev->bd_block_size = bsize;
>  	bdev->bd_inode->i_blkbits = blksize_bits(bsize);
>  }
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 6024877..b039b15 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -1571,6 +1571,12 @@ void create_empty_buffers(struct page *page,
>  	struct buffer_head *bh, *head, *tail;
>  
>  	head = alloc_page_buffers(page, blocksize, 1);
> +
> +	/*
> + 	 * alloc_page_buffers() could return NULL on (1) bs > PAGE_SIZE
> + 	 * (2) low memory case. Ensure that we don't dereference null ptr
> + 	 */  
> +	BUG_ON(!head);
>  	bh = head;
>  	do {
>  		bh->b_state |= b_state;
> 

Reviewed-by: Matias Bjorling <m@bjorling.me>