On 2021/10/7 20:44, Jan Kara wrote:
On Sat 11-09-21 17:00:57, Ye Bin wrote:
As call read_mmp_block pass bh_check which value is NULL, then call
sb_getblk to get buffer_head. But mmp_block's buffer_head is already exist
which also is uptodate. Lead to compare the same data.
Signed-off-by: Ye Bin <yebin10@xxxxxxxxxx>
This looks good, except that read_mmp_block() also releases bh it is passed
in case of error. So it can free buffer head which is still referenced from
EXT4_SB(sb)->s_mmp_bh and cause use-after-free issues.
I guess I would just get rid of sb_getblk() in read_mmp_block() and always
expect valid bh passed. The only place that passes NULL bh after this
patch is one case in ext4_multi_mount_protect() and that can call
sb_getblk() on its own. That way we can also simplify read_mmp_block()
prototype to:
static int read_mmp_block(struct super_block *sb, struct buffer_head *bh);
Honza
Yeah, I will refactor 'read_mmp_block'.
---
fs/ext4/mmp.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)
diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
index 4433fe7e9e86..007bde3c12b8 100644
--- a/fs/ext4/mmp.c
+++ b/fs/ext4/mmp.c
@@ -213,10 +213,7 @@ static int kmmpd(void *data)
* we need to check if the MMP block is as we write it.
*/
if (jiffies - last_check_time > mmp_check_interval * HZ) {
- struct buffer_head *bh_check = NULL;
- struct mmp_struct *mmp_check;
-
- retval = read_mmp_block(sb, &bh_check, mmp_block);
+ retval = read_mmp_block(sb, &bh, mmp_block);
if (retval) {
ext4_error_err(sb, -retval,
"error reading MMP data: %d",
@@ -224,20 +221,18 @@ static int kmmpd(void *data)
goto wait_to_exit;
}
- mmp_check = (struct mmp_struct *)(bh_check->b_data);
- if (seq != mmp_check->mmp_seq ||
- memcmp(nodename, mmp_check->mmp_nodename,
- sizeof(mmp->mmp_nodename))) {
- dump_mmp_msg(sb, mmp_check,
+ mmp = (struct mmp_struct *)(bh->b_data);
+ if (seq != le32_to_cpu(mmp->mmp_seq) ||
+ memcmp(nodename, mmp->mmp_nodename,
+ sizeof(nodename))) {
+ dump_mmp_msg(sb, mmp,
"Error while updating MMP info. "
"The filesystem seems to have been"
" multiply mounted.");
ext4_error_err(sb, EBUSY, "abort");
- put_bh(bh_check);
retval = -EBUSY;
goto wait_to_exit;
}
- put_bh(bh_check);
last_check_time = jiffies;
}
--
2.31.1
