diff options
| author | Chao Yu <yuchao0@huawei.com> | 2020-03-23 04:18:07 +0100 |
|---|---|---|
| committer | Jaegeuk Kim <jaegeuk@kernel.org> | 2020-03-31 05:46:25 +0200 |
| commit | 7653b9d87516ed65e112d2273c65eca6f97d0a27 (patch) | |
| tree | 4c14c83983524fdb2e37b5ca9d5ff7ce74d4464f /fs/f2fs/inode.c | |
| parent | f2fs: fix NULL pointer dereference in f2fs_verity_work() (diff) | |
| download | linux-7653b9d87516ed65e112d2273c65eca6f97d0a27.tar.xz linux-7653b9d87516ed65e112d2273c65eca6f97d0a27.zip | |
f2fs: fix potential .flags overflow on 32bit architecture
f2fs_inode_info.flags is unsigned long variable, it has 32 bits
in 32bit architecture, since we introduced FI_MMAP_FILE flag
when we support data compression, we may access memory cross
the border of .flags field, corrupting .i_sem field, result in
below deadlock.
To fix this issue, let's expand .flags as an array to grab enough
space to store new flags.
Call Trace:
__schedule+0x8d0/0x13fc
? mark_held_locks+0xac/0x100
schedule+0xcc/0x260
rwsem_down_write_slowpath+0x3ab/0x65d
down_write+0xc7/0xe0
f2fs_drop_nlink+0x3d/0x600 [f2fs]
f2fs_delete_inline_entry+0x300/0x440 [f2fs]
f2fs_delete_entry+0x3a1/0x7f0 [f2fs]
f2fs_unlink+0x500/0x790 [f2fs]
vfs_unlink+0x211/0x490
do_unlinkat+0x483/0x520
sys_unlink+0x4a/0x70
do_fast_syscall_32+0x12b/0x683
entry_SYSENTER_32+0xaa/0x102
Fixes: 4c8ff7095bef ("f2fs: support data compression")
Tested-by: Ondrej Jirman <megous@megous.com>
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Diffstat (limited to 'fs/f2fs/inode.c')
| -rw-r--r-- | fs/f2fs/inode.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index 44e08bf2e2b4..44582a4db513 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -362,7 +362,7 @@ static int do_read_inode(struct inode *inode) fi->i_flags = le32_to_cpu(ri->i_flags); if (S_ISREG(inode->i_mode)) fi->i_flags &= ~F2FS_PROJINHERIT_FL; - fi->flags = 0; + bitmap_zero(fi->flags, FI_MAX); fi->i_advise = ri->i_advise; fi->i_pino = le32_to_cpu(ri->i_pino); fi->i_dir_level = ri->i_dir_level; |