linux-ext4 - Re: [PATCH 1/3] jbd2: fix potential double free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190509104228.GD23589@quack2.suse.cz>
Date:   Thu, 9 May 2019 12:42:28 +0200
From:   Jan Kara <jack@...e.cz>
To:     "sunny.s.zhang" <sunny.s.zhang@...cle.com>
Cc:     Chengguang Xu <cgxu519@...il.com>, jack@...e.com, tytso@....edu,
        linux-ext4@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/3] jbd2: fix potential double free

On Wed 08-05-19 14:38:22, sunny.s.zhang wrote:
> Hi Chengguang,
> 
> 在 2019年05月05日 19:01, Chengguang Xu 写道:
> > When fail from creating cache jbd2_inode_cache, we will
> > destroy previously created cache jbd2_handle_cache twice.
> > This patch fixes it by removing first destroy in error path.
> > 
> > Signed-off-by: Chengguang Xu <cgxu519@...il.com>
> > ---
> >   fs/jbd2/journal.c | 1 -
> >   1 file changed, 1 deletion(-)
> > 
> > diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
> > index 382c030cc78b..49797854ccb8 100644
> > --- a/fs/jbd2/journal.c
> > +++ b/fs/jbd2/journal.c
> > @@ -2642,7 +2642,6 @@ static int __init jbd2_journal_init_handle_cache(void)
> >   	jbd2_inode_cache = KMEM_CACHE(jbd2_inode, 0);
> >   	if (jbd2_inode_cache == NULL) {
> >   		printk(KERN_EMERG "JBD2: failed to create inode cache\n");
> > -		kmem_cache_destroy(jbd2_handle_cache);
> Maybe we should keep it, and set the jbd2_handle_cache to NULL.
> If there are some changes in the future,  we may forget to change the
> function
> of jbd2_journal_destroy_handle_cache.

So what I'd do is that I'd split initialization of jbd2_inode_cache into a
separate function (and the same for destruction). That more aligns with how
things are currently done in jbd2 and also fixes the problem with double
destruction.

								Honza
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR