diff options
| author | Chao Yu <yuchao0@huawei.com> | 2020-03-23 06:18:07 +0300 |
|---|---|---|
| committer | Jaegeuk Kim <jaegeuk@kernel.org> | 2020-03-31 06:46:25 +0300 |
| commit | 7653b9d87516ed65e112d2273c65eca6f97d0a27 (patch) | |
| tree | 4c14c83983524fdb2e37b5ca9d5ff7ce74d4464f /scripts/gcc-plugins/sancov_plugin.c | |
| parent | 79bbefb19f1359fb2cbd144d5a054649e7e583be (diff) | |
| download | linux-7653b9d87516ed65e112d2273c65eca6f97d0a27.tar.xz | |
f2fs: fix potential .flags overflow on 32bit architecture
f2fs_inode_info.flags is unsigned long variable, it has 32 bits
in 32bit architecture, since we introduced FI_MMAP_FILE flag
when we support data compression, we may access memory cross
the border of .flags field, corrupting .i_sem field, result in
below deadlock.
To fix this issue, let's expand .flags as an array to grab enough
space to store new flags.
Call Trace:
__schedule+0x8d0/0x13fc
? mark_held_locks+0xac/0x100
schedule+0xcc/0x260
rwsem_down_write_slowpath+0x3ab/0x65d
down_write+0xc7/0xe0
f2fs_drop_nlink+0x3d/0x600 [f2fs]
f2fs_delete_inline_entry+0x300/0x440 [f2fs]
f2fs_delete_entry+0x3a1/0x7f0 [f2fs]
f2fs_unlink+0x500/0x790 [f2fs]
vfs_unlink+0x211/0x490
do_unlinkat+0x483/0x520
sys_unlink+0x4a/0x70
do_fast_syscall_32+0x12b/0x683
entry_SYSENTER_32+0xaa/0x102
Fixes: 4c8ff7095bef ("f2fs: support data compression")
Tested-by: Ondrej Jirman <megous@megous.com>
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Diffstat (limited to 'scripts/gcc-plugins/sancov_plugin.c')
0 files changed, 0 insertions, 0 deletions