linux-kernel - Re: [PATCH v2] Fix NULL pointer dereference in bl_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160721080910.GA20363@lst.de>
Date:	Thu, 21 Jul 2016 10:09:10 +0200
From:	Christoph Hellwig <hch@....de>
To:	Artem Savkov <asavkov@...hat.com>
Cc:	Anna Schumaker <Anna.Schumaker@...app.com>,
	linux-nfs@...r.kernel.org, linux-kernel@...r.kernel.org,
	trond.myklebust@...marydata.com, hch@....de
Subject: Re: [PATCH v2] Fix NULL pointer dereference in bl_free_device().

On Tue, Jul 19, 2016 at 05:39:04PM +0200, Artem Savkov wrote:
> When bl_parse_deviceid() fails in bl_alloc_deviceid_node() on
> blkdev_get_by_*() step we get an pnfs_block_dev struct that is
> uninitialized except for bdev field which is set to whatever error
> blkdev_get_by_*() returns.  bl_free_device() then tries to call
> blkdev_put() if bdev is not 0 resulting in a wrong pointer dereference.
> 
> Fixing this by making sure bdev is not an error code in bl_free_device().
> 
> Signed-off-by: Artem Savkov <asavkov@...hat.com>

I guess this is fine to be defensive, but we should probably just ensure
->bdev is NULLed on failure.