linux-kernel - Re: [PATCH] ocfs2: fix infinite loop for orphan entry list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <711323de-5a9f-db09-6105-319ff1ff52c1@linux.alibaba.com>
Date:   Fri, 25 Nov 2022 17:41:04 +0800
From:   Joseph Qi <joseph.qi@...ux.alibaba.com>
To:     lihongweizz <lihongweizz@...pur.com>, mark@...heh.com,
        jlbec@...lplan.org
Cc:     ocfs2-devel@....oracle.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ocfs2: fix infinite loop for orphan entry list



On 11/25/22 11:41 AM, lihongweizz wrote:
> Orphan file may be in the recover list already when the ip_next_orphan
> is NULL (for example, orphan file is second tail elementof recover
> list). In this scenario, the file could be added to the list twice
> and infinite loop happened. So we need another pointer value here(EFAULT)
>  instead of NULL for the list tail element.
> 

Don't understand how it happens. Is this a real issue you encountered?
When queue orphans, it will bypass those already in recover list.

Thanks,
Joseph

> Signed-off-by: lihongweizz <lihongweizz@...pur.com>
> ---
>  fs/ocfs2/journal.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
> index 126671e..4620013 100644
> --- a/fs/ocfs2/journal.c
> +++ b/fs/ocfs2/journal.c
> @@ -2207,7 +2207,7 @@ static int ocfs2_recover_orphans(struct ocfs2_super *osb,
>  				 enum ocfs2_orphan_reco_type orphan_reco_type)
>  {
>  	int ret = 0;
> -	struct inode *inode = NULL;
> +	struct inode *inode = ERR_PTR(-EFAULT);
>  	struct inode *iter;
>  	struct ocfs2_inode_info *oi;
>  	struct buffer_head *di_bh = NULL;
> @@ -2224,7 +2224,7 @@ static int ocfs2_recover_orphans(struct ocfs2_super *osb,
>  	if (ret)
>  		mlog_errno(ret);
>  
> -	while (inode) {
> +	while (!IS_ERR(inode)) {
>  		oi = OCFS2_I(inode);
>  		trace_ocfs2_recover_orphans_iput(
>  					(unsigned long long)oi->ip_blkno);