Dan Carpenter 1e74ccd38e ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() ... commit 37b0b6b8b9 upstream. If sbi->s_flex_groups_allocated is zero and the first allocation fails then this code will crash. The problem is that "i--" will set "i" to -1 but when we compare "i >= sbi->s_flex_groups_allocated" then the -1 is type promoted to unsigned and becomes UINT_MAX. Since UINT_MAX is more than zero, the condition is true so we call kvfree(new_groups[-1]). The loop will carry on freeing invalid memory until it crashes. Fixes: 7c990728b9 ("ext4: fix potential race between s_flex_groups online resizing and access") Reviewed-by: Suraj Jitindar Singh <surajjs@amazon.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable@kernel.org Link: https://lore.kernel.org/r/20200228092142.7irbc44yaz3by7nb@kili.mountain Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-03-05 16:43:41 +01:00
..
acl.c	ext4: compare old and new mode before setting update_mode flag	2018-12-10 00:22:38 -05:00
acl.h	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
balloc.c	ext4: fix potential race between online resizing and write operations	2020-02-28 17:22:22 +01:00
bitmap.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
block_validity.c	ext4: add cond_resched() to ext4_protect_reserved_inode	2020-02-19 19:52:59 +01:00
dir.c	ext4: fix checksum errors with indexed dirs	2020-02-19 19:52:59 +01:00
ext4_extents.h	ext4: adjust reserved cluster count when removing extents	2018-10-01 14:25:08 -04:00
ext4_jbd2.c	ext4: shutdown should not prevent get_write_access	2018-02-18 22:07:36 -05:00
ext4_jbd2.h	ext4: use jbd2_inode dirty range scoping	2019-06-20 17:26:26 -04:00
ext4.h	ext4: fix race between writepages and enabling EXT4_EXTENTS_FL	2020-02-28 17:22:23 +01:00
extents_status.c	ext4: use percpu_counters for extent_status cache hits/misses	2019-08-28 11:19:23 -04:00
extents_status.h	ext4: use percpu_counters for extent_status cache hits/misses	2019-08-28 11:19:23 -04:00
extents.c	ext4: fix warning inside ext4_convert_unwritten_extents_endio	2019-08-22 22:53:46 -04:00
file.c	ext4: fix ext4_dax_read/write inode locking sequence for IOCB_NOWAIT	2020-02-24 08:36:24 +01:00
fsmap.c	ext4: fix miscellaneous sparse warnings	2019-05-12 04:49:47 -04:00
fsmap.h	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
fsync.c	Revert "ext4: use ext4_write_inode() when fsyncing w/o a journal"	2019-01-31 23:41:11 -05:00
hash.c	ext4: fix kernel oops caused by spurious casefold flag	2019-09-03 01:43:17 -04:00
ialloc.c	ext4: fix potential race between s_flex_groups online resizing and access	2020-02-28 17:22:22 +01:00
indirect.c	ext4: clean up kerneldoc warnigns when building with W=1	2019-06-19 16:30:03 -04:00
inline.c	ext4: set error return correctly when ext4_htree_store_dirent fails	2019-08-12 14:29:38 -04:00
inode.c	ext4: rename s_journal_flag_rwsem to s_writepages_rwsem	2020-02-28 17:22:23 +01:00
ioctl.c	Added new ext4 debugging ioctls to allow userspace to get information	2019-09-21 13:37:39 -07:00
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	ext4: add basic fs-verity support	2019-08-12 19:33:50 -07:00
mballoc.c	ext4: fix potential race between s_flex_groups online resizing and access	2020-02-28 17:22:22 +01:00
mballoc.h	ext4: fix up remaining files with SPDX cleanups	2017-12-17 22:00:59 -05:00
migrate.c	ext4: fix race between writepages and enabling EXT4_EXTENTS_FL	2020-02-28 17:22:23 +01:00
mmp.c	ext4: don't assume that mmp_nodename/bdevname have NUL	2020-02-19 19:52:58 +01:00
move_extent.c	ext4: use jbd2_inode dirty range scoping	2019-06-20 17:26:26 -04:00
namei.c	ext4: add cond_resched() to __ext4_find_entry()	2020-02-28 17:22:22 +01:00
page-io.c	ext4: fix deadlock allocating crypto bounce page from mempool	2020-02-11 04:35:32 -08:00
readpage.c	ext4: fix deadlock allocating bio_post_read_ctx from mempool	2020-02-24 08:36:29 +01:00
resize.c	ext4: fix potential race between s_flex_groups online resizing and access	2020-02-28 17:22:22 +01:00
super.c	ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()	2020-03-05 16:43:41 +01:00
symlink.c	ext4: switch to fscrypt_get_symlink()	2018-01-11 22:10:40 -05:00
sysfs.c	ext4: add basic fs-verity support	2019-08-12 19:33:50 -07:00
truncate.h	ext4: handle layout changes to pinned DAX mappings	2018-07-29 17:00:22 -04:00
verity.c	ext4: add basic fs-verity support	2019-08-12 19:33:50 -07:00
xattr_security.c	ext4: use XATTR_CREATE in ext4_initxattrs()	2018-05-10 11:52:14 -04:00
xattr_trusted.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xattr_user.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xattr.c	ext4: ignore e_value_offs for xattrs with value-in-ea-inode	2019-04-10 00:37:36 -04:00
xattr.h	ext4: add extra checks to ext4_xattr_block_get()	2018-03-30 20:04:11 -04:00