diff options
| author | Lianjun Huang <huanglianjun@vivo.com> | 2018-06-16 22:59:46 +0800 |
|---|---|---|
| committer | Daniel Rosenberg <drosen@google.com> | 2018-06-18 14:55:40 -0700 |
| commit | d4dfd3570598d6b0f269c8165d274ea1a43c1739 (patch) | |
| tree | 31bb146e2d7dd31a86cb7bdd58cada4b04f9e5c6 | |
| parent | 5f342079c2f2464de1a044ea212e96589e4cf22e (diff) | |
ANDROID: sdcardfs: fix potential crash when reserved_mb is not zero
sdcardfs_mkdir() calls check_min_free_space(). When reserved_mb is not zero, a negative dentry will be passed to
ext4_statfs() at last and ext4_statfs() will crash. The parent dentry is positive. So we use the parent dentry to
check free space.
Change-Id: I80ab9623fe59ba911f4cc9f0e029a1c6f7ee421b
Signed-off-by: Lianjun Huang <huanglianjun@vivo.com>
| -rw-r--r-- | fs/sdcardfs/inode.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/fs/sdcardfs/inode.c b/fs/sdcardfs/inode.c index 6f04a18ad503..d92462ecd1f4 100644 --- a/fs/sdcardfs/inode.c +++ b/fs/sdcardfs/inode.c @@ -270,6 +270,7 @@ static int sdcardfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode struct dentry *lower_dentry; struct vfsmount *lower_mnt; struct dentry *lower_parent_dentry = NULL; + struct dentry *parent_dentry = NULL; struct path lower_path; struct sdcardfs_sb_info *sbi = SDCARDFS_SB(dentry->d_sb); const struct cred *saved_cred = NULL; @@ -289,11 +290,14 @@ static int sdcardfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode OVERRIDE_CRED(SDCARDFS_SB(dir->i_sb), saved_cred, SDCARDFS_I(dir)); /* check disk space */ - if (!check_min_free_space(dentry, 0, 1)) { + parent_dentry = dget_parent(dentry); + if (!check_min_free_space(parent_dentry, 0, 1)) { pr_err("sdcardfs: No minimum free space.\n"); err = -ENOSPC; + dput(parent_dentry); goto out_revert; } + dput(parent_dentry); /* the lower_dentry is negative here */ sdcardfs_get_lower_path(dentry, &lower_path); |