Dan Carpenter 37b0b6b8b9 ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() ... If sbi->s_flex_groups_allocated is zero and the first allocation fails then this code will crash. The problem is that "i--" will set "i" to -1 but when we compare "i >= sbi->s_flex_groups_allocated" then the -1 is type promoted to unsigned and becomes UINT_MAX. Since UINT_MAX is more than zero, the condition is true so we call kvfree(new_groups[-1]). The loop will carry on freeing invalid memory until it crashes. Fixes: 7c990728b9 ("ext4: fix potential race between s_flex_groups online resizing and access") Reviewed-by: Suraj Jitindar Singh <surajjs@amazon.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable@kernel.org Link: https://lore.kernel.org/r/20200228092142.7irbc44yaz3by7nb@kili.mountain Signed-off-by: Theodore Ts'o <tytso@mit.edu>		2020-02-29 17:48:08 -05:00
..
acl.c
acl.h
balloc.c	ext4: fix potential race between online resizing and write operations	2020-02-21 00:37:09 -05:00
bitmap.c
block_validity.c	ext4: add cond_resched() to ext4_protect_reserved_inode	2020-02-13 11:56:26 -05:00
dir.c	ext4: fix checksum errors with indexed dirs	2020-02-13 11:56:19 -05:00
ext4_extents.h	ext4: make some functions static in extents.c	2020-01-17 16:24:54 -05:00
ext4_jbd2.c	ext4: uninline ext4_inode_journal_mode()	2020-01-17 16:24:52 -05:00
ext4_jbd2.h	ext4: uninline ext4_inode_journal_mode()	2020-01-17 16:24:52 -05:00
ext4.h	ext4: fix race between writepages and enabling EXT4_EXTENTS_FL	2020-02-21 19:32:07 -05:00
extents_status.c	ext4: use percpu_counters for extent_status cache hits/misses	2019-08-28 11:19:23 -04:00
extents_status.h	ext4: fix extent_status trace points	2020-01-25 02:03:03 -05:00
extents.c	ext4: fix extent_status fragmentation for plain files	2020-01-23 12:02:15 -05:00
file.c	ext4: Optimize ext4 DIO overwrites	2019-12-26 11:57:18 -05:00
fsmap.c
fsmap.h
fsync.c	ext4: update ext4_sync_file() to not use __generic_file_fsync()	2019-11-05 11:31:40 -05:00
hash.c	ext4: fix kernel oops caused by spurious casefold flag	2019-09-03 01:43:17 -04:00
ialloc.c	ext4: fix potential race between s_flex_groups online resizing and access	2020-02-21 19:31:46 -05:00
indirect.c	ext4: remove ext4_{ind,ext}_calc_metadata_amount()	2020-01-17 16:24:54 -05:00
inline.c	ext4,jbd2: fix comment and code style	2020-01-25 02:24:53 -05:00
inode-test.c	kunit: allow kunit tests to be loaded as a module	2020-01-09 16:42:29 -07:00
inode.c	ext4: rename s_journal_flag_rwsem to s_writepages_rwsem	2020-02-21 19:32:07 -05:00
ioctl.c	ext4: Add EXT4_IOC_FSGETXATTR/EXT4_IOC_FSSETXATTR to compat_ioctl	2020-01-17 16:24:55 -05:00
Kconfig	This merge window, we've added some performance improvements in how we	2020-01-30 15:17:05 -08:00
Makefile	kunit: allow kunit tests to be loaded as a module	2020-01-09 16:42:29 -07:00
mballoc.c	ext4: fix potential race between s_flex_groups online resizing and access	2020-02-21 19:31:46 -05:00
mballoc.h
migrate.c	ext4: fix race between writepages and enabling EXT4_EXTENTS_FL	2020-02-21 19:32:07 -05:00
mmp.c	ext4: don't assume that mmp_nodename/bdevname have NUL	2020-02-13 11:53:10 -05:00
move_extent.c
namei.c	ext4: add cond_resched() to __ext4_find_entry()	2020-02-19 23:53:52 -05:00
page-io.c	ext4: fix deadlock allocating crypto bounce page from mempool	2020-01-17 16:24:54 -05:00
readpage.c	ext4: remove unneeded check for error allocating bio_post_read_ctx	2020-01-17 16:24:54 -05:00
resize.c	ext4: fix potential race between s_flex_groups online resizing and access	2020-02-21 19:31:46 -05:00
super.c	ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()	2020-02-29 17:48:08 -05:00
symlink.c
sysfs.c	ext4: export information about first/last errors via /sys/fs/ext4/<dev>	2019-12-26 11:29:10 -05:00
truncate.h
verity.c	fs-verity: implement readahead of Merkle tree pages	2020-01-14 13:27:32 -08:00
xattr_security.c
xattr_trusted.c
xattr_user.c
xattr.c	ext4: drop ext4_kvmalloc()	2020-01-17 16:24:55 -05:00
xattr.h