diff mbox

direct-io: Prevent NULL pointer access in submit_page_section

Message ID 20171009091318.26714-1-agruenba@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Andreas Gruenbacher Oct. 9, 2017, 9:13 a.m. UTC 
In the code added to function submit_page_section by commit b1058b981,
sdio->bio can currently be NULL when calling dio_bio_submit.  This then
leads to a NULL pointer access in dio_bio_submit, so check for a NULL
bio in submit_page_section before trying to submit it instead.

Fixes xfstest generic/250 on gfs2.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Jan Kara <jack@suse.cz>
---
 fs/direct-io.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Al Viro Oct. 9, 2017, 4:22 p.m. UTC | #1 
On Mon, Oct 09, 2017 at 11:13:18AM +0200, Andreas Gruenbacher wrote:
> In the code added to function submit_page_section by commit b1058b981,
> sdio->bio can currently be NULL when calling dio_bio_submit.  This then
> leads to a NULL pointer access in dio_bio_submit, so check for a NULL
> bio in submit_page_section before trying to submit it instead.
> 
> Fixes xfstest generic/250 on gfs2.
> 
> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
> Reviewed-by: Jan Kara <jack@suse.cz>

How far back in -stable should it go?  I'm fine with the patch, but I'd
rather have accurate Cc: stable in commit message...
Andreas Gruenbacher Oct. 9, 2017, 6:24 p.m. UTC | #2 
On 9 October 2017 at 18:22, Al Viro <viro@zeniv.linux.org.uk> wrote:
> On Mon, Oct 09, 2017 at 11:13:18AM +0200, Andreas Gruenbacher wrote:
>> In the code added to function submit_page_section by commit b1058b981,
>> sdio->bio can currently be NULL when calling dio_bio_submit.  This then
>> leads to a NULL pointer access in dio_bio_submit, so check for a NULL
>> bio in submit_page_section before trying to submit it instead.
>>
>> Fixes xfstest generic/250 on gfs2.
>>
>> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
>> Reviewed-by: Jan Kara <jack@suse.cz>
>
> How far back in -stable should it go?  I'm fine with the patch, but I'd
> rather have accurate Cc: stable in commit message...

The bug was introduced in 3.10, and apart from a trivial conflict with:

  09cbfeaf1a5a  mm, fs: get rid of PAGE_CACHE_* and
page_cache_{get,release} macros

from v4.6, it applies up to v3.10.

The conflict is in the diff context: page_cache_release has been
replaced by put_page.

Thanks,
Andreas
diff mbox

Patch

diff --git a/fs/direct-io.c b/fs/direct-io.c
index 5fa2211e49ae..e0332da392d8 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -838,7 +838,8 @@  submit_page_section(struct dio *dio, struct dio_submit *sdio, struct page *page,
 	 */
 	if (sdio->boundary) {
 		ret = dio_send_cur_page(dio, sdio, map_bh);
-		dio_bio_submit(dio, sdio);
+		if (sdio->bio)
+			dio_bio_submit(dio, sdio);
 		put_page(sdio->cur_page);
 		sdio->cur_page = NULL;
 	}