linux-ext4 - Re: [PATCH] handle optional-arg mount options better

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100215160150.GJ5337@thunk.org>
Date:	Mon, 15 Feb 2010 11:01:50 -0500
From:	tytso@....edu
To:	Eric Sandeen <sandeen@...hat.com>
Cc:	ext4 development <linux-ext4@...r.kernel.org>
Subject: Re: [PATCH] handle optional-arg mount options better

On Wed, Feb 03, 2010 at 03:13:30PM -0600, Eric Sandeen wrote:
> We have 2 mount options, "barrier" and "auto_da_alloc"
> which may or may not take a 1/0 argument.  This is confusing
> the parser, it seems, because if we pass it without an
> arg, it still tries to match_int for the arg, which
> is uninitialized, and match_number uses those uninit from/to
> values to do a kmalloc, resulting in potentially noisy
> failures.
> 
> I think just defining _arg variants of the tokens and
> handling them separately is the simplest fix.
> 
> Reported-by: Michael S. Tsirkin <mst@...hat.com>
> Signed-off-by: Eric Sandeen <sandeen@...hat.com>
> ---

This fix works just as well, and doesn't require _arg and _no_arg
versions of the token tags.

As long as we initialize arg[0], things should work correctly.  They
work correctly even without !args[0].from check, but I added that just
in case the implementation of the match_token library function changes
in the future.

						- Ted

commit 1e6276ea260bcd37284f4387c435239919fbc628
Author: Theodore Ts'o <tytso@....edu>
Date:   Mon Feb 15 11:00:12 2010 -0500

    ext4: Fix optional-arg mount options
    
    We have 2 mount options, "barrier" and "auto_da_alloc" which may or
    may not take a 1/0 argument.  This causes the ext4 superblock mount
    code to subtract uninitialized pointers and pass the result to
    kmalloc, which results in very noisy failures.
    
    Reported-by: Michael S. Tsirkin <mst@...hat.com>
    Signed-off-by: "Theodore Ts'o" <tytso@....edu>

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 735c20d..7e9a7ea 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1229,6 +1229,7 @@ static int parse_options(char *options, struct super_block *sb,
 		if (!*p)
 			continue;
 
+		args[0].to = args[0].from = 0;
 		token = match_token(p, tokens, args);
 		switch (token) {
 		case Opt_bsd_df:
@@ -1518,7 +1519,7 @@ set_qf_format:
 			clear_opt(sbi->s_mount_opt, BARRIER);
 			break;
 		case Opt_barrier:
-			if (match_int(&args[0], &option)) {
+			if (!args[0].from || match_int(&args[0], &option)) {
 				set_opt(sbi->s_mount_opt, BARRIER);
 				break;
 			}
@@ -1594,7 +1595,7 @@ set_qf_format:
 			set_opt(sbi->s_mount_opt,NO_AUTO_DA_ALLOC);
 			break;
 		case Opt_auto_da_alloc:
-			if (match_int(&args[0], &option)) {
+			if (!args[0].from || match_int(&args[0], &option)) {
 				clear_opt(sbi->s_mount_opt, NO_AUTO_DA_ALLOC);
 				break;
 			}


--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html