Porting the sdcard panic fix from qcom
authora17671 <a17671@motorola.com>
Tue, 18 Sep 2018 09:30:19 +0000 (17:30 +0800)
committerlingsen1 <lingsen1@lenovo.com>
Sun, 7 Feb 2021 09:36:47 +0000 (17:36 +0800)
Porting the change 226f96b0 from QCOM
Fix potential crash when reserved_mb is not zero
Author: Lianjun Huang <huanglianjun@vivo.com>
sdcardfs_mkdir() calls check_min_free_space(). When
reserved_mb is not zero, a negative dentry will be passed to
ext4_statfs at last and ext4_statfs() will crash. The parent dentry
is possitive. So we use the parrent dentry to check free space.

Change-Id: I0c7c6e38cf116660bc573a7e81a679366aa6c334
Signed-off-by: a17671 <a17671@motorola.com>
Reviewed-on: https://gerrit.mot.com/1242998
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Master Yoda
Reviewed-by: Xiangpo Zhao <zhaoxp3@motorola.com>
Submit-Approved: Jira Key

fs/sdcardfs/inode.c

index 4dd681e0d59d948374883a7e34ed8318d4537e23..6015d16576b239bc375af6ef3a30c5d8ee62c698 100644 (file)
@@ -66,6 +66,7 @@ static int sdcardfs_create(struct inode *dir, struct dentry *dentry,
        struct dentry *lower_dentry;
        struct vfsmount *lower_dentry_mnt;
        struct dentry *lower_parent_dentry = NULL;
+       struct dentry *parent_dentry = NULL;
        struct path lower_path;
        const struct cred *saved_cred = NULL;
        struct fs_struct *saved_fs;
@@ -82,6 +83,14 @@ static int sdcardfs_create(struct inode *dir, struct dentry *dentry,
        if (!saved_cred)
                return -ENOMEM;
 
+       parent_dentry = dget_parent(dentry);
+        if (!check_min_free_space(parent_dentry, 0, 1)) {
+                pr_err("sdcardfs: No minimum free space.\n");
+                err = -ENOSPC;
+                dput(parent_dentry);
+                goto out_revert;
+        }
+        dput(parent_dentry);
        sdcardfs_get_lower_path(dentry, &lower_path);
        lower_dentry = lower_path.dentry;
        lower_dentry_mnt = lower_path.mnt;
@@ -122,7 +131,8 @@ out:
 out_unlock:
        unlock_dir(lower_parent_dentry);
        sdcardfs_put_lower_path(dentry, &lower_path);
-       revert_fsids(saved_cred);
+out_revert:    
+        revert_fsids(saved_cred);
 out_eacces:
        return err;
 }