]> git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/commit
udf: Fix NULL ptr deref when converting from inline format
authorJan Kara <jack@suse.cz>
Mon, 17 Jan 2022 17:22:13 +0000 (18:22 +0100)
committerStefan Bader <stefan.bader@canonical.com>
Tue, 29 Mar 2022 07:13:37 +0000 (09:13 +0200)
commit599a0fe72c3137ee151b7964d5ea5a9d22aa48e7
tree2a4027e5735784ab3017974cc7ef1f3eb89abf1d
parent0e7f7971cb542cb041de8f64ad55182422ef4d9f
udf: Fix NULL ptr deref when converting from inline format

BugLink: https://bugs.launchpad.net/bugs/1962345
commit 7fc3b7c2981bbd1047916ade327beccb90994eee upstream.

udf_expand_file_adinicb() calls directly ->writepage to write data
expanded into a page. This however misses to setup inode for writeback
properly and so we can crash on inode->i_wb dereference when submitting
page for IO like:

  BUG: kernel NULL pointer dereference, address: 0000000000000158
  #PF: supervisor read access in kernel mode
...
  <TASK>
  __folio_start_writeback+0x2ac/0x350
  __block_write_full_page+0x37d/0x490
  udf_expand_file_adinicb+0x255/0x400 [udf]
  udf_file_write_iter+0xbe/0x1b0 [udf]
  new_sync_write+0x125/0x1c0
  vfs_write+0x28e/0x400

Fix the problem by marking the page dirty and going through the standard
writeback path to write the page. Strictly speaking we would not even
have to write the page but we want to catch e.g. ENOSPC errors early.

Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
CC: stable@vger.kernel.org
Fixes: 52ebea749aae ("writeback: make backing_dev_info host cgroup-specific bdi_writebacks")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
fs/udf/inode.c