linux-kernel - Re: [BUG] fs: f2fs: Possible null-pointer dereferences in update_general

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 26 Jul 2019 11:19:41 +0800
From:   Chao Yu <yuchao0@...wei.com>
To:     Jia-Ju Bai <baijiaju1990@...il.com>, <jaegeuk@...nel.org>
CC:     <linux-f2fs-devel@...ts.sourceforge.net>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [BUG] fs: f2fs: Possible null-pointer dereferences in
 update_general_status()

Hi Jiaju,

Thanks for the report, I checked the code, and found it doesn't need to check
SM_I(sbi) pointer, this is because in fill_super() and put_super(), we will call
f2fs_destroy_stats() in prior to f2fs_destroy_segment_manager(), so if current
sbi can still be visited in global stat list, SM_I(sbi) should be released yet.
So anyway, let's remove unneeded check in line 70/78. :)

Thanks,

On 2019/7/25 17:49, Jia-Ju Bai wrote:
> In update_general_status(), there are two if statements to
> check whether SM_I(sbi) is NULL:
> LINE 70:     if (SM_I(sbi) && SM_I(sbi)->fcc_info)
> LINE 78:     if (SM_I(sbi) && SM_I(sbi)->dcc_info)
> 
> When SM_I(sbi) is NULL, it is used at some places, such as:
> LINE 88: reserved_segments(sbi)
>                    return SM_I(sbi)->reserved_segments;
> LINE 89: overprovision_segments(sbi)
>                    return SM_I(sbi)->ovp_segments;
> LINE 112: MAIN_SEGS(sbi)
>                      (SM_I(sbi)->main_segments)
> 
> Thus, possible null-pointer dereferences may occur.
> 
> These bugs are found by a static analysis tool STCheck written by us.
> 
> I do not know how to correctly fix these bugs, so I only report them.
> 
> 
> Best wishes,
> Jia-Ju Bai
> .
>