ocfs2: fix NULL pointer dereference in ocfs2_duplicate_clusters_by_page
PATCH RESEND 1/1 ocfs2: fix NULL pointer dereference in ocfs2_duplicate_clusters_by_page
From: Tiger Yang <[email protected]>
Since ocfs2_cow_file_pos will invoke ocfs2_refcount_icow with a NULL as the struct file pointer, it finally result in a null pointer dereference in ocfs2_duplicate_clusters_by_page.
This patch replace file pointer with inode pointer in cow_duplicate_clusters to fix this issue.
[Jeff: rebased patch against linux-next tree]
Cc Joel Becker <[email protected]>
Cc Mark Fasheh <[email protected]>
Acked-by Tao Ma <[email protected]>
Tested-by David Weber <[email protected]>
Signed-off-by Tiger Yang <[email protected]>
Signed-off-by Jie Liu <[email protected]>
--- fs/ocfs2/aops.c | 2 +- fs/ocfs2/file.c | 6 +++--- fs/ocfs2/move_extents.c | 2 +- fs/ocfs2/refcounttree.c | 53 +++++++---------------------------------------- fs/ocfs2/refcounttree.h | 6 +++--- 5 files changed, 16 insertions(+), 53 deletions(-)
fs/ocfs2/aops.c +1 -1
@@ -1757,7 +1757,7 @@ try_again: goto out; }else if (ret ==1 ) { clusters_need = wc->w_clen; - ret =ocfs2_refcount_cow (inode, filp, di_bh, + ret =ocfs2_refcount_cow (inode, di_bh, wc->w_cpos, wc->w_clen,UINT_MAX );if (ret) {mlog_errno (ret);
fs/ocfs2/file.c +3 -3
@@ -370,7 +370,7 @@ static int ocfs2_cow_file_pos(struct inode *inode,if (!(ext_flags &OCFS2_EXT_REFCOUNTED )) goto out; -return ocfs2_refcount_cow (inode,NULL , fe_bh, cpos,1 , cpos+1 ); +return ocfs2_refcount_cow (inode, fe_bh, cpos,1 , cpos+1 ); out:return status;
@@ -899,7 +899,7 @@ static int ocfs2_zero_extend_get_range(struct inode *inode, zero_clusters = last_cpos - zero_cpos;if (needs_cow) { - rc =ocfs2_refcount_cow (inode,NULL , di_bh, zero_cpos, + rc =ocfs2_refcount_cow (inode, di_bh, zero_cpos, zero_clusters,UINT_MAX );if (rc) {mlog_errno (rc);
@@ -2078,7 +2078,7 @@ static int ocfs2_prepare_inode_for_refcount(struct inode *inode, *meta_level =1 ; - ret =ocfs2_refcount_cow (inode, file, di_bh, cpos, clusters,UINT_MAX ); + ret =ocfs2_refcount_cow (inode, di_bh, cpos, clusters,UINT_MAX );if (ret)mlog_errno (ret); out:
fs/ocfs2/move_extents.c +1 -1
@@ -69,7 +69,7 @@ static int __ocfs2_move_extent(handle_t *handle,u64 ino =ocfs2_metadata_cache_owner (context->et.et_ci);u64 old_blkno =ocfs2_clusters_to_blocks (inode->i_sb, p_cpos); - ret =ocfs2_duplicate_clusters_by_page (handle, context->file, cpos, + ret =ocfs2_duplicate_clusters_by_page (handle, inode, cpos, p_cpos, new_p_cpos, len);if (ret) {mlog_errno (ret);
fs/ocfs2/refcounttree.c +8 -45
139 lines not on this page · raw message
fs/ocfs2/refcounttree.h +3 -3
@@ -53,7 +53,7 @@ int ocfs2_prepare_refcount_change_for_del(struct inode *inode,int *credits, int *ref_blocks);int ocfs2_refcount_cow (struct inode *inode, -struct file *filep,struct buffer_head *di_bh, +struct buffer_head *di_bh,u32 cpos,u32 write_len,u32 max_cpos); typedef int (ocfs2_post_refcount_func)(struct inode *inode,
@@ -85,11 +85,11 @@ int ocfs2_refcount_cow_xattr(struct inode *inode, u32 cpos, u32 write_len, struct ocfs2_post_refcount *post);int ocfs2_duplicate_clusters_by_page (handle_t *handle, -struct file *file, +struct inode *inode,u32 cpos,u32 old_cluster,u32 new_cluster,u32 new_len);int ocfs2_duplicate_clusters_by_jbd (handle_t *handle, -struct file *file, +struct inode *inode,u32 cpos,u32 old_cluster,u32 new_cluster,u32 new_len); int ocfs2_cow_sync_writeback(struct super_block *sb,
Signature · 1 line
1.7.9.5