• Carlos Maiolino's avatar
    ext4: fix possible non-initialized variable in htree_dirblock_to_tree() · 90b0a973
    Carlos Maiolino authored
    htree_dirblock_to_tree() declares a non-initialized 'err' variable,
    which is passed as a reference to another functions expecting them to
    set this variable with their error codes.
    It's passed to ext4_bread(), which then passes it to ext4_getblk(). If
    ext4_map_blocks() returns 0 due to a lookup failure, leaving the
    ext4_getblk() buffer_head uninitialized, it will make ext4_getblk()
    return to ext4_bread() without initialize the 'err' variable, and
    ext4_bread() will return to htree_dirblock_to_tree() with this variable
    still uninitialized.  htree_dirblock_to_tree() will pass this variable
    with garbage back to ext4_htree_fill_tree(), which expects a number of
    directory entries added to the rb-tree. which, in case, might return a
    fake non-zero value due the garbage left in the 'err' variable, leading
    the kernel to an Oops in ext4_dx_readdir(), once this is expecting a
    filled rb-tree node, when in turn it will have a NULL-ed one, causing an
    invalid page request when trying to get a fname struct from this NULL-ed
    rb-tree node in this line:
    fname = rb_entry(info->curr_node, struct fname, rb_hash);
    The patch itself initializes the err variable in
    htree_dirblock_to_tree() to avoid usage mistakes by the called
    functions, and also fix ext4_getblk() to return a initialized 'err'
    variable when ext4_map_blocks() fails a lookup.
    Signed-off-by: default avatarCarlos Maiolino <cmaiolino@redhat.com>
    Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>