linux-kernel - Re: [PATCH 1/2] hfs: fix potential refcnt problem of nls module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 19 Apr 2018 09:18:53 +0800
From:   "cgxu519@....com" <cgxu519@....com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     "cgxu519@....com" <cgxu519@....com>, linux-fsdevel@...r.kernel.org,
        dhowells@...hat.com, kstewart@...uxfoundation.org,
        gregkh@...uxfoundation.org, tglx@...utronix.de,
        pombredanne@...b.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] hfs: fix potential refcnt problem of nls module

在 2018年4月19日，上午3:42，Andrew Morton <akpm@...ux-foundation.org> 写道：
> 
> On Tue, 17 Apr 2018 15:05:32 +0800 Chengguang Xu <cgxu519@....com> wrote:
> 
>> When specifying iocharset/codepage multiple times in a mount,
>> current option parsing will cause inaccurate refcount of nls
>> module. Hence, call unload_nls for previous one in this case.
>> 
>> ...
>> 
>> --- a/fs/hfs/super.c
>> +++ b/fs/hfs/super.c
>> @@ -329,8 +329,10 @@ static int parse_options(char *options, struct hfs_sb_info *hsb)
>> 				return 0;
>> 			}
>> 			p = match_strdup(&args[0]);
>> -			if (p)
>> +			if (p) {
>> +				unload_nls(hsb->nls_disk);
>> 				hsb->nls_disk = load_nls(p);
>> +			}
>> 			if (!hsb->nls_disk) {
>> 				pr_err("unable to load codepage \"%s\"\n", p);
>> 				kfree(p);
>> @@ -344,8 +346,10 @@ static int parse_options(char *options, struct hfs_sb_info *hsb)
>> 				return 0;
>> 			}
>> 			p = match_strdup(&args[0]);
>> -			if (p)
>> +			if (p) {
>> +				unload_nls(hsb->nls_io);
>> 				hsb->nls_io = load_nls(p);
>> +			}
>> 			if (!hsb->nls_io) {
>> 				pr_err("unable to load iocharset \"%s\"\n", p);
>> 				kfree(p);
> 
> Confused.
> 
> 			break;
> : 		case opt_codepage:
> : 			if (hsb->nls_disk) {
> : 				pr_err("unable to change codepage\n");
> : 				return 0;
> : 			}
> 
> Here, hsb->nls_disk is known to be zero.
> 
> : 			p = match_strdup(&args[0]);
> : 			if (p) {
> : 				unload_nls(hsb->nls_disk);
> 
> So this will always do unload_nls(0).
> 
> : 				hsb->nls_disk = load_nls(p);
> : 			}
> 
> And the same applies to your opt_iocharset change.

You are right. Sorry I just misread this part, please just drop the patch.

Thanks.