]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
ext4: fix potential race between s_flex_groups online resizing and access
authorSuraj Jitindar Singh <surajjs@amazon.com>
Sat, 29 Feb 2020 00:48:17 +0000 (16:48 -0800)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Tue, 7 Apr 2020 08:50:50 +0000 (10:50 +0200)
commit0cbb12242272d40353d8b6e67cb081896c367f1e
tree3190b10485c0183d0ea9a2be2292a79e26daadc8
parent5f45f0eab29606802b606856ca93fa425cc3b6e3
ext4: fix potential race between s_flex_groups online resizing and access

BugLink: https://bugs.launchpad.net/bugs/1868623
commit 7c990728b99ed6fbe9c75fc202fce1172d9916da upstream.

During an online resize an array of s_flex_groups structures gets replaced
so it can get enlarged. If there is a concurrent access to the array and
this memory has been reused then this can lead to an invalid memory access.

The s_flex_group array has been converted into an array of pointers rather
than an array of structures. This is to ensure that the information
contained in the structures cannot get out of sync during a resize due to
an accessor updating the value in the old structure after it has been
copied but before the array pointer is updated. Since the structures them-
selves are no longer copied but only the pointers to them this case is
mitigated.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=206443
Link: https://lore.kernel.org/r/20200221053458.730016-4-tytso@mit.edu
Signed-off-by: Suraj Jitindar Singh <surajjs@amazon.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org # 4.14.x
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
fs/ext4/ext4.h
fs/ext4/ialloc.c
fs/ext4/mballoc.c
fs/ext4/resize.c
fs/ext4/super.c