• Jan Kara's avatar
    udf: Fix NULL ptr deref when converting from inline format · 7fc3b7c2
    Jan Kara authored
    udf_expand_file_adinicb() calls directly ->writepage to write data
    expanded into a page. This however misses to setup inode for writeback
    properly and so we can crash on inode->i_wb dereference when submitting
    page for IO like:
    
      BUG: kernel NULL pointer dereference, address: 0000000000000158
      #PF: supervisor read access in kernel mode
    ...
      <TASK>
      __folio_start_writeback+0x2ac/0x350
      __block_write_full_page+0x37d/0x490
      udf_expand_file_adinicb+0x255/0x400 [udf]
      udf_file_write_iter+0xbe/0x1b0 [udf]
      new_sync_write+0x125/0x1c0
      vfs_write+0x28e/0x400
    
    Fix the problem by marking the page dirty and going through the standard
    writeback path to write the page. Strictly speaking we would not even
    have to write the page but we want to catch e.g. ENOSPC errors early.
    Reported-by: default avatarbutt3rflyh4ck <butterflyhuangxx@gmail.com>
    CC: stable@vger.kernel.org
    Fixes: 52ebea74 ("writeback: make backing_dev_info host cgroup-specific bdi_writebacks")
    Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
    Signed-off-by: default avatarJan Kara <jack@suse.cz>
    7fc3b7c2
inode.c 67.1 KB