linux-kernel - [PATCH] udf: fix potential refcnt problem of nls module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 25 Feb 2018 21:25:07 +0800
From:   Chengguang Xu <cgxu519@...oud.com>
To:     jack@...e.cz
Cc:     linux-kernel@...r.kernel.org, Chengguang Xu <cgxu519@...oud.com>
Subject: [PATCH] udf: fix potential refcnt problem of nls module

When specifiying iocharset multiple times in a mount
or once/multiple in a remount, current option parsing
may cause inaccurate refcount of nls module.
Also, in the failure cleanup of option parsing,
the condition of calling unload_nls is not sufficient.

Signed-off-by: Chengguang Xu <cgxu519@...oud.com>
---

Hi Jan,

I found this issue by checking code so now post the fix for rewiew,
but sorry I did't get enough resource to fully test it, I can only
make sure the fix can successfuly comiple with no error.

 fs/udf/super.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/fs/udf/super.c b/fs/udf/super.c
index 7b27b06..7e73a98 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -523,8 +523,12 @@ static int udf_parse_options(char *options, struct udf_options *uopt,
 			break;
 #ifdef CONFIG_UDF_NLS
 		case Opt_iocharset:
-			uopt->nls_map = load_nls(args[0].from);
-			uopt->flags |= (1 << UDF_FLAG_NLS_MAP);
+			if (!remount) {
+				if (uopt->nls_map)
+					unload_nls(uopt->nls_map);
+				uopt->nls_map = load_nls(args[0].from);
+				uopt->flags |= (1 << UDF_FLAG_NLS_MAP);
+			}
 			break;
 #endif
 		case Opt_uignore:
@@ -2082,8 +2086,8 @@ error_out:
 		for (i = 0; i < sbi->s_partitions; i++)
 			udf_free_partition(&sbi->s_partmaps[i]);
 #ifdef CONFIG_UDF_NLS
-	if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP))
-		unload_nls(sbi->s_nls_map);
+	if (uopt.nls_map)
+		unload_nls(uopt.nls_map);
 #endif
 	if (!(sb->s_flags & MS_RDONLY))
 		udf_close_lvid(sb);
-- 
1.8.3.1