FAILED: patch "[PATCH] ext4: fix use-after-free race in ext4_remount()'s error path" failed to apply to 4.4-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
Quoted 1 line
From
33458eaba4dfe778a426df6a19b7aad2ff9f7eecMon Sep 17 00:00:00 2001
From: Theodore Ts'o <[email protected]>
Date: Fri, 12 Oct 2018 09:28:09 -0400
Subject: [PATCH] ext4: fix use-after-free race in ext4_remount()'s error path
It's possible for ext4_show_quota_options() to try reading s_qf_names[i] while it is being modified by ext4_remount() --- most notably, in ext4_remount's error path when the original values of the quota file name gets restored.
fs/ext4/ext4.h +2 -1
@@ -1405,7 +1405,8 @@ struct ext4_sb_info {u32 s_min_batch_time;struct block_device *journal_bdev;#ifdef CONFIG_QUOTA -char *s_qf_names[EXT4_MAXQUOTAS ];/* Names of quota files with journalled quota */ +/* Names of quota files with journalled quota */ +char __rcu *s_qf_names[EXT4_MAXQUOTAS ];int s_jquota_fmt;/* Format of quota to use */ #endif unsigned int s_want_extra_isize;/* New inodes should reserve # bytes */
fs/ext4/super.c +48 -25
167 lines not on this page · raw message