linux-kernel - [PATCH] f2fs: compress: fix to avoid NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20200117075903.6157-1-yuchao0@huawei.com>
Date:   Fri, 17 Jan 2020 15:59:03 +0800
From:   Chao Yu <yuchao0@...wei.com>
To:     <jaegeuk@...nel.org>
CC:     <linux-f2fs-devel@...ts.sourceforge.net>,
        <linux-kernel@...r.kernel.org>, <chao@...nel.org>,
        Chao Yu <yuchao0@...wei.com>
Subject: [PATCH] f2fs: compress: fix to avoid NULL pointer dereference

If cluster has only one compressed page, race condition as below will
trigger NULL pointer dereference:

- f2fs_write_compressed_pages
 - cic->rpages[0] = cc->rpages[0];
 - f2fs_outplace_write_data
					- f2fs_compress_write_end_io
					 - WARN_ON(!cic->rpages[1]);
 - cic->rpages[1] = cc->rpages[1];

Signed-off-by: Chao Yu <yuchao0@...wei.com>
---
 fs/f2fs/compress.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index 45a6f20ceb3e..d8a64be90a50 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -837,12 +837,15 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
 
 	set_cluster_writeback(cc);
 
+	for (i = 0; i < cc->cluster_size; i++)
+		cic->rpages[i] = cc->rpages[i];
+
 	for (i = 0; i < cc->cluster_size; i++, dn.ofs_in_node++) {
 		block_t blkaddr;
 
 		blkaddr = datablock_addr(dn.inode, dn.node_page,
 							dn.ofs_in_node);
-		fio.page = cic->rpages[i] = cc->rpages[i];
+		fio.page = cic->rpages[i];
 		fio.old_blkaddr = blkaddr;
 
 		/* cluster header */
-- 
2.18.0.rc1