linux-kernel - [PATCH] ocfs2: fix infinite loop for orphan entry list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 25 Nov 2022 11:41:18 +0800
From:   lihongweizz <lihongweizz@...pur.com>
To:     <mark@...heh.com>, <jlbec@...lplan.org>,
        <joseph.qi@...ux.alibaba.com>
CC:     <ocfs2-devel@....oracle.com>, <linux-kernel@...r.kernel.org>,
        lihongweizz <lihongweizz@...pur.com>
Subject: [PATCH] ocfs2: fix infinite loop for orphan entry list

Orphan file may be in the recover list already when the ip_next_orphan
is NULL (for example, orphan file is second tail elementof recover
list). In this scenario, the file could be added to the list twice
and infinite loop happened. So we need another pointer value here(EFAULT)
 instead of NULL for the list tail element.

Signed-off-by: lihongweizz <lihongweizz@...pur.com>
---
 fs/ocfs2/journal.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index 126671e..4620013 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -2207,7 +2207,7 @@ static int ocfs2_recover_orphans(struct ocfs2_super *osb,
 				 enum ocfs2_orphan_reco_type orphan_reco_type)
 {
 	int ret = 0;
-	struct inode *inode = NULL;
+	struct inode *inode = ERR_PTR(-EFAULT);
 	struct inode *iter;
 	struct ocfs2_inode_info *oi;
 	struct buffer_head *di_bh = NULL;
@@ -2224,7 +2224,7 @@ static int ocfs2_recover_orphans(struct ocfs2_super *osb,
 	if (ret)
 		mlog_errno(ret);
 
-	while (inode) {
+	while (!IS_ERR(inode)) {
 		oi = OCFS2_I(inode);
 		trace_ocfs2_recover_orphans_iput(
 					(unsigned long long)oi->ip_blkno);
-- 
1.8.3.1