On May 8, 2019, at 2:34 AM, Sahitya Tummala <[email protected]> wrote: > > The buffer_head (frames[0].bh) and it's corresping page can be > potentially free'd once brelse() is done inside the for loop > but before the for loop exits in dx_release(). It can be free'd > in another context, when the page cache is flushed via > drop_caches_sysctl_handler(). This results into below data abort > when accessing info->indirect_levels in dx_release(). > > Unable to handle kernel paging request at virtual address ffffffc17ac3e01e > Call trace: > dx_release+0x70/0x90 > ext4_htree_fill_tree+0x2d4/0x300 > ext4_readdir+0x244/0x6f8 > iterate_dir+0xbc/0x160 > SyS_getdents64+0x94/0x174 > > Signed-off-by: Sahitya Tummala <[email protected]>
Reviewed-by: Andreas Dilger <[email protected]> > --- > v2: > add a comment in dx_release() > > fs/ext4/namei.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c > index 980166a..5d9ffa8 100644 > --- a/fs/ext4/namei.c > +++ b/fs/ext4/namei.c > @@ -871,12 +871,15 @@ static void dx_release(struct dx_frame *frames) > { > struct dx_root_info *info; > int i; > + unsigned int indirect_levels; > > if (frames[0].bh == NULL) > return; > > info = &((struct dx_root *)frames[0].bh->b_data)->info; > - for (i = 0; i <= info->indirect_levels; i++) { > + /* save local copy, "info" may be freed after brelse() */ > + indirect_levels = info->indirect_levels; > + for (i = 0; i <= indirect_levels; i++) { > if (frames[i].bh == NULL) > break; > brelse(frames[i].bh); > -- > Qualcomm India Private Limited, on behalf of Qualcomm Innovation Center, Inc. > Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a Linux > Foundation Collaborative Project. > Cheers, Andreas
signature.asc
Description: Message signed with OpenPGP
