diff options
| author | Dan Carpenter <[email protected]> | 2020-02-28 09:22:56 +0000 |
|---|---|---|
| committer | Theodore Ts'o <[email protected]> | 2020-02-29 22:48:08 +0000 |
| commit | 37b0b6b8b99c0e1c1f11abbe7cf49b6d03795b3f (patch) | |
| tree | e5b072f6e69c2b726c70c865015763d395680d6a /scripts/basic/fixdep.c | |
| parent | jbd2: fix data races at struct journal_head (diff) | |
| download | kernel-37b0b6b8b99c0e1c1f11abbe7cf49b6d03795b3f.tar.gz kernel-37b0b6b8b99c0e1c1f11abbe7cf49b6d03795b3f.zip | |
ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()
If sbi->s_flex_groups_allocated is zero and the first allocation fails
then this code will crash. The problem is that "i--" will set "i" to
-1 but when we compare "i >= sbi->s_flex_groups_allocated" then the -1
is type promoted to unsigned and becomes UINT_MAX. Since UINT_MAX
is more than zero, the condition is true so we call kvfree(new_groups[-1]).
The loop will carry on freeing invalid memory until it crashes.
Fixes: 7c990728b99e ("ext4: fix potential race between s_flex_groups online resizing and access")
Reviewed-by: Suraj Jitindar Singh <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Cc: [email protected]
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Theodore Ts'o <[email protected]>
Diffstat (limited to 'scripts/basic/fixdep.c')
0 files changed, 0 insertions, 0 deletions