| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20201102083604.GT18329@kadam>
Date: Mon, 2 Nov 2020 11:36:04 +0300
From: Dan Carpenter <dan.carpenter@...cle.com>
To: kbuild@...ts.01.org,
Konstantin Komarov <almaz.alexandrovich@...agon-software.com>,
linux-fsdevel@...r.kernel.org
Cc: lkp@...el.com, Dan Carpenter <error27@...il.com>,
kbuild-all@...ts.01.org, viro@...iv.linux.org.uk,
linux-kernel@...r.kernel.org, pali@...nel.org, dsterba@...e.cz,
aaptel@...e.com, willy@...radead.org, rdunlap@...radead.org,
joe@...ches.com, mark@...mstone.com
Subject: [kbuild] Re: [PATCH v11 09/10] fs/ntfs3: Add NTFS3 in fs/Kconfig and
fs/Makefile
Hi Konstantin,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on linus/master]
[also build test WARNING on v5.10-rc2 next-20201030]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch ]
url: https://github.com/0day-ci/linux/commits/Konstantin-Komarov/NTFS-read-write-driver-GPL-implementation-by-Paragon-Software/20201031-220904
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 5fc6b075e165f641fbc366b58b578055762d5f8c
config: i386-randconfig-m021-20201101 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
smatch warnings:
fs/ntfs3/attrib.c:331 attr_set_size_res() error: dereferencing freed memory 'attr_s'
fs/ntfs3/attrib.c:1267 attr_allocate_frame() error: uninitialized symbol 'hint'.
fs/ntfs3/attrib.c:1393 attr_allocate_frame() error: we previously assumed 'attr_b' could be null (see line 1306)
fs/ntfs3/namei.c:438 ntfs_rename() warn: variable dereferenced before check 'old_inode' (see line 296)
fs/ntfs3/fsntfs.c:844 ntfs_clear_mft_tail() error: uninitialized symbol 'err'.
fs/ntfs3/fsntfs.c:1294 ntfs_read_run_nb() error: uninitialized symbol 'idx'.
fs/ntfs3/frecord.c:166 ni_load_mi_ex() error: we previously assumed 'r' could be null (see line 159)
fs/ntfs3/frecord.c:505 ni_ins_new_attr() error: we previously assumed 'le' could be null (see line 490)
fs/ntfs3/frecord.c:658 ni_repack() warn: 'run.runs_' double freed
fs/ntfs3/frecord.c:1439 ni_insert_nonresident() warn: potential memory corrupting cast 8 vs 2 bytes
fs/ntfs3/frecord.c:2214 ni_read_frame() warn: ignoring unreachable code.
fs/ntfs3/xattr.c:514 ntfs_get_acl_ex() warn: passing zero to 'ERR_PTR'
fs/ntfs3/index.c:1133 indx_find() warn: variable dereferenced before check 'fnd' (see line 1117)
fs/ntfs3/index.c:1371 indx_find_raw() error: we previously assumed 'n' could be null (see line 1349)
fs/ntfs3/index.c:1404 indx_create_allocate() warn: should '1 << indx->index_bits' be a 64 bit type?
fs/ntfs3/index.c:1755 indx_insert_into_root() warn: possible memory leak of 're'
fs/ntfs3/index.c:549 hdr_find_split() warn: variable dereferenced before check 'e' (see line 547)
fs/ntfs3/inode.c:687 ntfs_readpage() warn: should 'page->index << 12' be a 64 bit type?
fs/ntfs3/fslog.c:2205 last_log_lsn() warn: possible memory leak of 'page_bufs'
fs/ntfs3/fslog.c:2418 find_log_rec() error: we previously assumed 'rh' could be null (see line 2404)
fs/ntfs3/fslog.c:2551 find_client_next_lsn() error: double free of 'lcb->lrh'
fs/ntfs3/fslog.c:639 enum_rstbl() error: we previously assumed 't' could be null (see line 628)
fs/ntfs3/fslog.c:3158 do_action() warn: variable dereferenced before check 'mi' (see line 3118)
fs/ntfs3/fslog.c:3913 log_replay() error: dereferencing freed memory 'rst_info.r_page'
vim +/attr_s +331 fs/ntfs3/attrib.c
e3a1cdcc648083 Konstantin Komarov 2020-10-30 241 static int attr_set_size_res(struct ntfs_inode *ni, struct ATTRIB *attr,
e3a1cdcc648083 Konstantin Komarov 2020-10-30 242 struct ATTR_LIST_ENTRY *le, struct mft_inode *mi,
e3a1cdcc648083 Konstantin Komarov 2020-10-30 243 u64 new_size, struct runs_tree *run,
e3a1cdcc648083 Konstantin Komarov 2020-10-30 244 struct ATTRIB **ins_attr)
e3a1cdcc648083 Konstantin Komarov 2020-10-30 245 {
e3a1cdcc648083 Konstantin Komarov 2020-10-30 246 int err = 0;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 247 struct ntfs_sb_info *sbi = mi->sbi;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 248 struct MFT_REC *rec = mi->mrec;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 249 u32 used = le32_to_cpu(rec->used);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 250 u32 asize = le32_to_cpu(attr->size);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 251 u32 aoff = PtrOffset(rec, attr);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 252 u32 rsize = le32_to_cpu(attr->res.data_size);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 253 u32 tail = used - aoff - asize;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 254 char *next = Add2Ptr(attr, asize);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 255 int dsize = QuadAlign(new_size) - QuadAlign(rsize);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 256 CLST len, alen;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 257 struct ATTRIB *attr_s = NULL;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 258 bool is_ext;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 259
e3a1cdcc648083 Konstantin Komarov 2020-10-30 260 if (dsize < 0) {
e3a1cdcc648083 Konstantin Komarov 2020-10-30 261 memmove(next + dsize, next, tail);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 262 } else if (dsize > 0) {
e3a1cdcc648083 Konstantin Komarov 2020-10-30 263 if (used + dsize > sbi->max_bytes_per_attr)
e3a1cdcc648083 Konstantin Komarov 2020-10-30 264 goto resident2nonresident;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 265
e3a1cdcc648083 Konstantin Komarov 2020-10-30 266 memmove(next + dsize, next, tail);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 267 memset(next, 0, dsize);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 268 }
e3a1cdcc648083 Konstantin Komarov 2020-10-30 269
e3a1cdcc648083 Konstantin Komarov 2020-10-30 270 rec->used = cpu_to_le32(used + dsize);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 271 attr->size = cpu_to_le32(asize + dsize);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 272 attr->res.data_size = cpu_to_le32(new_size);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 273 mi->dirty = true;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 274 *ins_attr = attr;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 275
e3a1cdcc648083 Konstantin Komarov 2020-10-30 276 return 0;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 277
e3a1cdcc648083 Konstantin Komarov 2020-10-30 278 resident2nonresident:
e3a1cdcc648083 Konstantin Komarov 2020-10-30 279 len = bytes_to_cluster(sbi, rsize);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 280
e3a1cdcc648083 Konstantin Komarov 2020-10-30 281 run_init(run);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 282
e3a1cdcc648083 Konstantin Komarov 2020-10-30 283 is_ext = is_attr_ext(attr);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 284
e3a1cdcc648083 Konstantin Komarov 2020-10-30 285 if (!len) {
e3a1cdcc648083 Konstantin Komarov 2020-10-30 286 alen = 0;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 287 } else if (is_ext) {
e3a1cdcc648083 Konstantin Komarov 2020-10-30 288 if (!run_add_entry(run, 0, SPARSE_LCN, len)) {
e3a1cdcc648083 Konstantin Komarov 2020-10-30 289 err = -ENOMEM;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 290 goto out;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 291 }
e3a1cdcc648083 Konstantin Komarov 2020-10-30 292 alen = len;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 293 } else {
e3a1cdcc648083 Konstantin Komarov 2020-10-30 294 err = attr_allocate_clusters(sbi, run, 0, 0, len, NULL,
e3a1cdcc648083 Konstantin Komarov 2020-10-30 295 ALLOCATE_DEF, &alen, 0, NULL);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 296 if (err)
e3a1cdcc648083 Konstantin Komarov 2020-10-30 297 goto out;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 298
e3a1cdcc648083 Konstantin Komarov 2020-10-30 299 err = ntfs_sb_write_run(sbi, run, 0, resident_data(attr),
e3a1cdcc648083 Konstantin Komarov 2020-10-30 300 rsize);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 301 if (err)
e3a1cdcc648083 Konstantin Komarov 2020-10-30 302 goto out;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 303 }
e3a1cdcc648083 Konstantin Komarov 2020-10-30 304
e3a1cdcc648083 Konstantin Komarov 2020-10-30 305 attr_s = ntfs_memdup(attr, asize);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 306 if (!attr_s) {
e3a1cdcc648083 Konstantin Komarov 2020-10-30 307 err = -ENOMEM;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 308 goto out;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 309 }
e3a1cdcc648083 Konstantin Komarov 2020-10-30 310
e3a1cdcc648083 Konstantin Komarov 2020-10-30 311 /*verify(mi_remove_attr(mi, attr));*/
e3a1cdcc648083 Konstantin Komarov 2020-10-30 312 used -= asize;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 313 memmove(attr, Add2Ptr(attr, asize), used - aoff);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 314 rec->used = cpu_to_le32(used);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 315 mi->dirty = true;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 316 if (le)
e3a1cdcc648083 Konstantin Komarov 2020-10-30 317 al_remove_le(ni, le);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 318
e3a1cdcc648083 Konstantin Komarov 2020-10-30 319 err = ni_insert_nonresident(ni, attr_s->type, attr_name(attr_s),
e3a1cdcc648083 Konstantin Komarov 2020-10-30 320 attr_s->name_len, run, 0, alen,
e3a1cdcc648083 Konstantin Komarov 2020-10-30 321 attr_s->flags, &attr, NULL);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 322 if (err)
e3a1cdcc648083 Konstantin Komarov 2020-10-30 323 goto out;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 324
e3a1cdcc648083 Konstantin Komarov 2020-10-30 325 ntfs_free(attr_s);
^^^^^^^^^^^^^^^^^
Freed.
e3a1cdcc648083 Konstantin Komarov 2020-10-30 326 attr->nres.data_size = cpu_to_le64(rsize);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 327 attr->nres.valid_size = attr->nres.data_size;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 328
e3a1cdcc648083 Konstantin Komarov 2020-10-30 329 *ins_attr = attr;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 330
e3a1cdcc648083 Konstantin Komarov 2020-10-30 @331 if (attr_s->type == ATTR_DATA && !attr_s->name_len &&
^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^
Dereferenced after a free.
e3a1cdcc648083 Konstantin Komarov 2020-10-30 332 run == &ni->file.run) {
e3a1cdcc648083 Konstantin Komarov 2020-10-30 333 ni->ni_flags &= ~NI_FLAG_RESIDENT;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 334 }
e3a1cdcc648083 Konstantin Komarov 2020-10-30 335
e3a1cdcc648083 Konstantin Komarov 2020-10-30 336 /* Resident attribute becomes non resident */
e3a1cdcc648083 Konstantin Komarov 2020-10-30 337 return 0;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 338
e3a1cdcc648083 Konstantin Komarov 2020-10-30 339 out:
e3a1cdcc648083 Konstantin Komarov 2020-10-30 340 /* undo: do not trim new allocated clusters */
e3a1cdcc648083 Konstantin Komarov 2020-10-30 341 run_deallocate(sbi, run, false);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 342 run_close(run);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 343
e3a1cdcc648083 Konstantin Komarov 2020-10-30 344 if (attr_s) {
e3a1cdcc648083 Konstantin Komarov 2020-10-30 345 memmove(next, Add2Ptr(rec, aoff), used - aoff);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 346 memcpy(Add2Ptr(rec, aoff), attr_s, asize);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 347 rec->used = cpu_to_le32(used + asize);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 348 mi->dirty = true;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 349 ntfs_free(attr_s);
e3a1cdcc648083 Konstantin Komarov 2020-10-30 350 /*reinsert le*/
e3a1cdcc648083 Konstantin Komarov 2020-10-30 351 }
e3a1cdcc648083 Konstantin Komarov 2020-10-30 352
e3a1cdcc648083 Konstantin Komarov 2020-10-30 353 return err;
e3a1cdcc648083 Konstantin Komarov 2020-10-30 354 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
Download attachment ".config.gz" of type "application/gzip" (32884 bytes)
_______________________________________________
kbuild mailing list -- kbuild@...ts.01.org
To unsubscribe send an email to kbuild-leave@...ts.01.org
Powered by blists - more mailing lists