Vulnerability: fs/ext4/namei.c in the Linux kernel before 3.7 allows physically proximate attackers to cause a denial of service (system crash) via a crafted no-journal filesystem, a related issue to CVE-2013-2015.
Vulnerability ID: CVE-2015-7509
CWE: CWE-20
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2015-12-28
File: fs/ext4/namei.c
Commit message: ext4: make orphan functions be no-op in no-journal mode

Instead of checking whether the handle is valid, we check if journal
is enabled. This avoids taking the s_orphan_lock mutex in all cases
when there is no journal in use, including the error paths where
ext4_orphan_del() is called with a handle set to NULL.

Signed-off-by: Anatol Pomozov <anatol.pomozov@gmail.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Commit author: Anatol Pomozov

Vulnerable version (before fix):
 int ext4_orphan_add(handle_t *handle, struct inode *inode) 	struct ext4_iloc iloc; 	int err = 0, rc;  	if (!ext4_handle_valid(handle)) 		return 0;  	mutex_lock(&EXT4_SB(sb)->s_orphan_lock); int ext4_orphan_del(handle_t *handle, struct inode *inode) 	struct ext4_iloc iloc; 	int err = 0;  	/* ext4_handle_valid() assumes a valid handle_t pointer */ 	if (handle && !ext4_handle_valid(handle)) 		return 0;  	mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock); int ext4_orphan_del(handle_t *handle, struct inode *inode) 	 * transaction handle with which to update the orphan list on 	 * disk, but we still need to remove the inode from the linked 	 * list in memory. */ 	if (sbi->s_journal && !handle) 		goto out;  	err = ext4_reserve_inode_write(handle, inode, &iloc);

Fixed version (after fix):
 int ext4_orphan_add(handle_t *handle, struct inode *inode) 	struct ext4_iloc iloc; 	int err = 0, rc;  	if (!EXT4_SB(sb)->s_journal) 		return 0;  	mutex_lock(&EXT4_SB(sb)->s_orphan_lock); int ext4_orphan_del(handle_t *handle, struct inode *inode) 	struct ext4_iloc iloc; 	int err = 0;  	if (!EXT4_SB(inode->i_sb)->s_journal) 		return 0;  	mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock); int ext4_orphan_del(handle_t *handle, struct inode *inode) 	 * transaction handle with which to update the orphan list on 	 * disk, but we still need to remove the inode from the linked 	 * list in memory. */ 	if (!handle) 		goto out;  	err = ext4_reserve_inode_write(handle, inode, &iloc);

Patch:
patch: @@ -2369,7 +2369,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
 	struct ext4_iloc iloc;
 	int err = 0, rc;
 
-	if (!ext4_handle_valid(handle))
+	if (!EXT4_SB(sb)->s_journal)
 		return 0;
 
 	mutex_lock(&EXT4_SB(sb)->s_orphan_lock);
@@ -2443,8 +2443,7 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
 	struct ext4_iloc iloc;
 	int err = 0;
 
-	/* ext4_handle_valid() assumes a valid handle_t pointer */
-	if (handle && !ext4_handle_valid(handle))
+	if (!EXT4_SB(inode->i_sb)->s_journal)
 		return 0;
 
 	mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);
@@ -2463,7 +2462,7 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
 	 * transaction handle with which to update the orphan list on
 	 * disk, but we still need to remove the inode from the linked
 	 * list in memory. */
-	if (sbi->s_journal && !handle)
+	if (!handle)
 		goto out;
 
 	err = ext4_reserve_inode_write(handle, inode, &iloc);
path: fs/ext4/namei.c