linux-ext4 - Re: [PATCH 2/2] ext3: ext3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 4 Oct 2012 14:47:43 -0300
From:	Carlos Maiolino <cmaiolino@...hat.com>
To:	linux-ext4@...r.kernel.org
Subject: Re: [PATCH 2/2] ext3: ext3_bread usage audit [V2]

On Thu, Oct 04, 2012 at 04:29:00PM +0200, Jan Kara wrote:
> On Thu 04-10-12 10:57:46, Carlos Maiolino wrote:
> > On Thu, Oct 04, 2012 at 03:02:44PM +0200, Jan Kara wrote:
> > > On Thu 04-10-12 14:42:12, Jan Kara wrote:
> > > > On Tue 02-10-12 23:59:23, Carlos Maiolino wrote:
> > > > > This is the ext3 version of the same patch applied to Ext4, where such goal is
> > > > > to audit the usage of ext3_bread() due a possible misinterpretion of its return
> > > > > value.
> > > > > 
> > > > > Focused on directory blocks, a NULL value returned from ext3_bread() means a
> > > > > hole, which cannot exist into a directory inode. It can pass undetected after a
> > > > > fix in an uninitialized error variable.
> > > > > 
> > > > > The (now) initialized variable into ext3_getblk() may lead to a zero'ed return
> > > > > value of ext3_bread() to its callers, which can make the caller do not detect
> > > > > the hole in the directory inode.
> > > > > 
> > > > > This checks for directory holes when buffer_head and error value are both
> > > > > zero'ed returning -EIO to their callers
> > > > > 
> > > > > Some ext3_bread() callers do not needed any changes either because they already
> > > > > had its own hole detector paths or because these are deprecaded (like
> > > > > dx_show_entries)
> > > > > 
> > > > > V2: It adds a wrapper function ext3_dir_bread() to check for directory holes
> > > > > when reading blocks for a directory inode, and callers of ext3_bread() to read
> > > > > directory blocks were replaced by this wrapper.
> > > > > 
> > > > > Signed-off-by: Carlos Maiolino <cmaiolino@...hat.com>
> > > >   Oh, I see you already sent V2. Thanks. I've put the patch to my tree.
> > >   Umm, after checking - any reason why you didn't convert also ext3_bread()
> > > in dir.c and ext3_bread() in ext3_rename()?
> > > 
> > I didn't convert some calls for ext3_bread() - like ext3_readdir() -
> > because those really don't care about the err value, only about if bh is
> > valid or not. I can change this if you want, not a problem from my point.
>   Right. I've converted the call in ext3_rename() because there it seems
> useful. In ext3_readdir() calling ext3_bread() is better because we want
> to be able to read the faulty directory.

K, so I don't need to send a V3?

cheers
-- 
--Carlos
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html