| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 8 Nov 2021 09:10:57 +0800
From: Dongliang Mu <mudongliangabcd@...il.com>
To: Dave Kleikamp <dave.kleikamp@...cle.com>
Cc: jfs-discussion@...ts.sourceforge.net,
linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] JFS: fix memleak in jfs_mount
On Thu, Sep 23, 2021 at 10:54 PM Dave Kleikamp <dave.kleikamp@...cle.com> wrote:
>
> On 9/22/21 19:53, Dongliang Mu wrote:
> > Any update on this thread?
>
> Sorry for taking this long to get back to it. The patch looks good. It
> should show up in linux-next shortly.
>
Hi Dave,
In my local syzkaller testing, the upstream is still vulnerable to
this patch. How does the patch applied in linux-next propagate to
upstream?
> Shaggy
>
> >
> > On Sat, Sep 4, 2021 at 10:38 AM Dongliang Mu <mudongliangabcd@...il.com> wrote:
> >>
> >> In jfs_mount, when diMount(ipaimap2) fails, it goes to errout35. However,
> >> the following code does not free ipaimap2 allocated by diReadSpecial.
> >>
> >> Fix this by refactoring the error handling code of jfs_mount. To be
> >> specific, modify the lable name and free ipaimap2 when the above error
> >> ocurrs.
> >>
> >> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> >> Signed-off-by: Dongliang Mu <mudongliangabcd@...il.com>
> >> ---
> >> v1->v2: change "return rc" to "goto out"; fix one coding style
> >> fs/jfs/jfs_mount.c | 51 ++++++++++++++++++++--------------------------
> >> 1 file changed, 22 insertions(+), 29 deletions(-)
> >>
> >> diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
> >> index 5d7d7170c03c..aa4ff7bcaff2 100644
> >> --- a/fs/jfs/jfs_mount.c
> >> +++ b/fs/jfs/jfs_mount.c
> >> @@ -81,14 +81,14 @@ int jfs_mount(struct super_block *sb)
> >> * (initialize mount inode from the superblock)
> >> */
> >> if ((rc = chkSuper(sb))) {
> >> - goto errout20;
> >> + goto out;
> >> }
> >>
> >> ipaimap = diReadSpecial(sb, AGGREGATE_I, 0);
> >> if (ipaimap == NULL) {
> >> jfs_err("jfs_mount: Failed to read AGGREGATE_I");
> >> rc = -EIO;
> >> - goto errout20;
> >> + goto out;
> >> }
> >> sbi->ipaimap = ipaimap;
> >>
> >> @@ -99,7 +99,7 @@ int jfs_mount(struct super_block *sb)
> >> */
> >> if ((rc = diMount(ipaimap))) {
> >> jfs_err("jfs_mount: diMount(ipaimap) failed w/rc = %d", rc);
> >> - goto errout21;
> >> + goto err_ipaimap;
> >> }
> >>
> >> /*
> >> @@ -108,7 +108,7 @@ int jfs_mount(struct super_block *sb)
> >> ipbmap = diReadSpecial(sb, BMAP_I, 0);
> >> if (ipbmap == NULL) {
> >> rc = -EIO;
> >> - goto errout22;
> >> + goto err_umount_ipaimap;
> >> }
> >>
> >> jfs_info("jfs_mount: ipbmap:0x%p", ipbmap);
> >> @@ -120,7 +120,7 @@ int jfs_mount(struct super_block *sb)
> >> */
> >> if ((rc = dbMount(ipbmap))) {
> >> jfs_err("jfs_mount: dbMount failed w/rc = %d", rc);
> >> - goto errout22;
> >> + goto err_ipbmap;
> >> }
> >>
> >> /*
> >> @@ -139,7 +139,7 @@ int jfs_mount(struct super_block *sb)
> >> if (!ipaimap2) {
> >> jfs_err("jfs_mount: Failed to read AGGREGATE_I");
> >> rc = -EIO;
> >> - goto errout35;
> >> + goto err_umount_ipbmap;
> >> }
> >> sbi->ipaimap2 = ipaimap2;
> >>
> >> @@ -151,7 +151,7 @@ int jfs_mount(struct super_block *sb)
> >> if ((rc = diMount(ipaimap2))) {
> >> jfs_err("jfs_mount: diMount(ipaimap2) failed, rc = %d",
> >> rc);
> >> - goto errout35;
> >> + goto err_ipaimap2;
> >> }
> >> } else
> >> /* Secondary aggregate inode table is not valid */
> >> @@ -168,7 +168,7 @@ int jfs_mount(struct super_block *sb)
> >> jfs_err("jfs_mount: Failed to read FILESYSTEM_I");
> >> /* open fileset secondary inode allocation map */
> >> rc = -EIO;
> >> - goto errout40;
> >> + goto err_umount_ipaimap2;
> >> }
> >> jfs_info("jfs_mount: ipimap:0x%p", ipimap);
> >>
> >> @@ -178,41 +178,34 @@ int jfs_mount(struct super_block *sb)
> >> /* initialize fileset inode allocation map */
> >> if ((rc = diMount(ipimap))) {
> >> jfs_err("jfs_mount: diMount failed w/rc = %d", rc);
> >> - goto errout41;
> >> + goto err_ipimap;
> >> }
> >>
> >> - goto out;
> >> + return rc;
> >>
> >> /*
> >> * unwind on error
> >> */
> >> - errout41: /* close fileset inode allocation map inode */
> >> +err_ipimap:
> >> + /* close fileset inode allocation map inode */
> >> diFreeSpecial(ipimap);
> >> -
> >> - errout40: /* fileset closed */
> >> -
> >> +err_umount_ipaimap2:
> >> /* close secondary aggregate inode allocation map */
> >> - if (ipaimap2) {
> >> + if (ipaimap2)
> >> diUnmount(ipaimap2, 1);
> >> +err_ipaimap2:
> >> + /* close aggregate inodes */
> >> + if (ipaimap2)
> >> diFreeSpecial(ipaimap2);
> >> - }
> >> -
> >> - errout35:
> >> -
> >> - /* close aggregate block allocation map */
> >> +err_umount_ipbmap: /* close aggregate block allocation map */
> >> dbUnmount(ipbmap, 1);
> >> +err_ipbmap: /* close aggregate inodes */
> >> diFreeSpecial(ipbmap);
> >> -
> >> - errout22: /* close aggregate inode allocation map */
> >> -
> >> +err_umount_ipaimap: /* close aggregate inode allocation map */
> >> diUnmount(ipaimap, 1);
> >> -
> >> - errout21: /* close aggregate inodes */
> >> +err_ipaimap: /* close aggregate inodes */
> >> diFreeSpecial(ipaimap);
> >> - errout20: /* aggregate closed */
> >> -
> >> - out:
> >> -
> >> +out:
> >> if (rc)
> >> jfs_err("Mount JFS Failure: %d", rc);
> >>
> >> --
> >> 2.25.1
> >>
Powered by blists - more mailing lists