linux-kernel - Re: [PATCH] udf: fix potential refcnt problem of nls module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180228123606.z3zcwawbvh4g72ym@quack2.suse.cz>
Date:   Wed, 28 Feb 2018 13:36:06 +0100
From:   Jan Kara <jack@...e.cz>
To:     Chengguang Xu <cgxu519@...oud.com>
Cc:     jack@...e.cz, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] udf: fix potential refcnt problem of nls module

On Sun 25-02-18 21:25:07, Chengguang Xu wrote:
> When specifiying iocharset multiple times in a mount
> or once/multiple in a remount, current option parsing
> may cause inaccurate refcount of nls module.
> Also, in the failure cleanup of option parsing,
> the condition of calling unload_nls is not sufficient.
> 
> Signed-off-by: Chengguang Xu <cgxu519@...oud.com>
> ---
> 
> Hi Jan,
> 
> I found this issue by checking code so now post the fix for rewiew,
> but sorry I did't get enough resource to fully test it, I can only
> make sure the fix can successfuly comiple with no error.

Thanks for the patch. I have added it to my tree.

								Honza

> 
>  fs/udf/super.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/udf/super.c b/fs/udf/super.c
> index 7b27b06..7e73a98 100644
> --- a/fs/udf/super.c
> +++ b/fs/udf/super.c
> @@ -523,8 +523,12 @@ static int udf_parse_options(char *options, struct udf_options *uopt,
>  			break;
>  #ifdef CONFIG_UDF_NLS
>  		case Opt_iocharset:
> -			uopt->nls_map = load_nls(args[0].from);
> -			uopt->flags |= (1 << UDF_FLAG_NLS_MAP);
> +			if (!remount) {
> +				if (uopt->nls_map)
> +					unload_nls(uopt->nls_map);
> +				uopt->nls_map = load_nls(args[0].from);
> +				uopt->flags |= (1 << UDF_FLAG_NLS_MAP);
> +			}
>  			break;
>  #endif
>  		case Opt_uignore:
> @@ -2082,8 +2086,8 @@ error_out:
>  		for (i = 0; i < sbi->s_partitions; i++)
>  			udf_free_partition(&sbi->s_partmaps[i]);
>  #ifdef CONFIG_UDF_NLS
> -	if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP))
> -		unload_nls(sbi->s_nls_map);
> +	if (uopt.nls_map)
> +		unload_nls(uopt.nls_map);
>  #endif
>  	if (!(sb->s_flags & MS_RDONLY))
>  		udf_close_lvid(sb);
> -- 
> 1.8.3.1
> 
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR