linux-ext4 - re: ext4: fix potential use after free during resize

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sat, 6 Dec 2014 16:53:41 +0300
From:	Dan Carpenter <dan.carpenter@...cle.com>
To:	dmonakhov@...nvz.org
Cc:	linux-ext4@...r.kernel.org
Subject: re: ext4: fix potential use after free during resize

Hello Dmitry Monakhov,

The patch fdfe07398761: "ext4: fix potential use after free during
resize" from Dec 2, 2014, leads to the following static checker
warning:

	fs/ext4/balloc.c:300 ext4_get_group_desc()
	warn: 'gd_bh' can't be NULL.

This is a false positive in Smatch, but I still had a question about the
code.

fs/ext4/balloc.c
   295          group_desc = block_group >> EXT4_DESC_PER_BLOCK_BITS(sb);
   296          offset = block_group & (EXT4_DESC_PER_BLOCK(sb) - 1);
   297          rcu_read_lock();
   298          gd_bh = *rcu_dereference(sbi->s_group_desc) + group_desc;
   299          rcu_read_unlock();
   300          if (!gd_bh) {

Are you sure you don't want to "*rcu_dereference(sbi->s_group_desc)"
separate from group_desc?

		gd_bh = *rcu_dereference(sbi->s_group_desc);
		rcu_read_unlock();
		if (!gd_bh) {
			...
		}
		gd_bh = (u8 *) + group_desc;

   301                  ext4_error(sb, "Group descriptor not loaded - "
   302                             "block_group = %u, group_desc = %u, desc = %u",
   303                             block_group, group_desc, offset);
                                                ^^^^^^^^^^
We already know this is zero.

   304                  return NULL;
   305          }
   306  
   307          desc = (struct ext4_group_desc *)(
   308                  (__u8 *)gd_bh->b_data + offset * EXT4_DESC_SIZE(sb));
   309          if (bh)
   310                  *bh = gd_bh;

regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html