| Message ID | tencent_7F29369E974036964A3E742F778567CC3C09@qq.com |
|---|---|
| State | Rejected |
| Headers | show |
| Series | jbd2: user-memory-access in jbd2__journal_start | expand |
On Wed 31-01-24 20:04:27, Edward Adam Davis wrote: > Before reusing the handle, it is necessary to confirm that the transaction is > ready. > > Reported-and-tested-by: syzbot+cdee56dbcdf0096ef605@syzkaller.appspotmail.com > Signed-off-by: Edward Adam Davis <eadavis@qq.com> Sorry but no. Dave found a way to fix this particular problem in XFS and your patch would not really improve anything because we'd just crash when dereferencing handle->saved_alloc_context. Honza > diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c > index cb0b8d6fc0c6..702312cd5392 100644 > --- a/fs/jbd2/transaction.c > +++ b/fs/jbd2/transaction.c > @@ -493,6 +493,9 @@ handle_t *jbd2__journal_start(journal_t *journal, int nblocks, int rsv_blocks, > return ERR_PTR(-EROFS); > > if (handle) { > + if (handle->saved_alloc_context & ~PF_MEMALLOC_NOFS) > + return ERR_PTR(-EBUSY); > + > J_ASSERT(handle->h_transaction->t_journal == journal); > handle->h_ref++; > return handle; > -- > 2.43.0 >
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index cb0b8d6fc0c6..702312cd5392 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -493,6 +493,9 @@ handle_t *jbd2__journal_start(journal_t *journal, int nblocks, int rsv_blocks, return ERR_PTR(-EROFS); if (handle) { + if (handle->saved_alloc_context & ~PF_MEMALLOC_NOFS) + return ERR_PTR(-EBUSY); + J_ASSERT(handle->h_transaction->t_journal == journal); handle->h_ref++; return handle;
Before reusing the handle, it is necessary to confirm that the transaction is ready. Reported-and-tested-by: syzbot+cdee56dbcdf0096ef605@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> --- fs/jbd2/transaction.c | 3 +++ 1 file changed, 3 insertions(+)